A layer 4 firewall that can: Track the state of network connections Determine if a packet is part of a current connection