in addition to the simple packet filtering (above) this kind of firewall also keeps track of connections. a packet can be the start of a new connection, or it can be part of an existing connection. if it is neither of the two, it is probably useless and can be dropped.