Most of us have some knowledge about firewalls. We know that firewalls are one of the building blocks of digital security. We know that they protect us from harmful files, malware, and network connections. And lastly, we know that we need them to stay safe online.
What many don’t know, however, is that there’s more than one type of firewall, and your overall digital security depends on which type you choose to use.
This guide is a crash course on a popular type of firewall called an SPI firewall. What does SPI stand for? How does the firewall work? Is it better than other types of firewall? We’ll answer all those questions and more, so keep reading.
What Does the SPI in SPI Firewall Stand For?
The “SPI” in SPI firewall stands for “stateful packet inspection.” OK, so that probably didn’t clear anything up, but hang in there. In order to understand how SPI firewalls work, we’ll need to backtrack and review how firewalls operate in general.
What Does a Firewall Do?
In 1965, Ford put its recently introduced Mustang on the viewing deck of the Empire State Building.1 Rather than transporting the entire vehicle, though, they chopped it up into smaller sections and then reassembled it at the top.
The same principle applies to online data transfer. When you try to load a webpage, download a file, or stream a video, the data is chopped up into smaller chunks called data packets. These data packets are transported to your end and then recreated to form the original file.
Here’s where your firewall comes in. It inspects those data packets individually to see if they are safe to let through. The firewall then disregards those that it deems unsafe, either because they are from a suspicious source, contain malware, or don’t correspond to the rest of the incoming packet stream.
The different types of firewall are categorized based on how they inspect data packets. There’s SPI, stateless packet inspection, and deep packet inspection, or DPI. But since our focus here is on SPI firewalls, let’s talk about how this type of firewall works and how it protects you.
FYI: There are many other different types of firewalls, like packet filtering firewall, proxy firewall, and circuit-level gateway firewall, but SPI, stateless, and DPI firewalls are the most commonly used types.
How an SPI Firewall Works
An SPI firewall is a type of firewall that is context-aware. It is sometimes called a dynamic packet filtering or a smart firewall because, unlike the other types of firewalls, its rules for filtering data packets aren’t set in stone. Instead, it looks at the context of incoming data packets and whether or not they correspond to active connections. It can also recognize patterns, allowing it to prevent attacks that work outside the packet level.
Here’s an example: A SYN flood is one of the most brutal forms of DDoS (Distributed Denial of Service) attacks.2 It floods the victim’s network with SYN packets to open multiple active communication ports until it becomes overwhelming for the network. This type of attack is effective because the SYN packets are not malicious and they can come from unsuspicious sources, so firewalls that check only for those things won’t be able to stop the attack.
An SPI firewall, however, will notice that a large number of SYN packets is coming from a single IP address, which it will construe as abnormal. As a result, it will close opened communication ports to prevent a breach.
That’s another advantage of an SPI firewall over stateless packet inspection: It can close communication ports rather than just disregard data packets to stop potentially harmful connections.
Are SPI Firewalls Better Than Other Types of Firewalls?
As stated earlier, the different types of firewall differ in the way they inspect data packets. Is the method of SPI firewalls better? Let’s compare it to stateless packet inspection and DPI.
Stateless vs. Stateful Packet Inspection
Stateless packet inspection is one of the most basic types of firewall. It filters traffic using a set of rules that look at fixed values; for example, the source and destination of a data packet, the communication port it uses, or even its size.
Stateless firewalls also don’t examine the content of data packets. They just look at a packet and determine if it satisfies the entry rules. But the thing is, they apply the same set of rules for different packets. Because of that, if you’re using a stateless firewall, you need to configure its rules in order to make it suitable for security.
Of course, stateless firewalls have a few advantages over SPI firewalls. Because stateless firewalls don’t have to examine the contents of data packets, they are faster and can handle larger amounts of incoming traffic. If you’re buying a firewall solution, stateless firewalls are also more affordable.
In terms of security, though, SPI firewalls are far better than stateless firewalls. SPI firewalls examine the content and the context of incoming packets, which means they can spot a broader range of anomalies and threats.
DPI vs. SPI Firewalls
A DPI firewall, on the other hand, is one of the most thorough types of firewall, but it focuses mostly on the contents of data packets rather than the context.
DPI firewalls deconstructs data packets to check their contents. They make sure that the data is formed correctly and that it doesn’t contain any malicious code. It’s the equivalent of opening a package and inspecting what’s inside before accepting it.
Are DPI firewalls better than SPI firewalls? The answer is not a simple yes or no.
DPI firewalls are better at detecting and stopping certain types of attacks that involve the use of malware or malicious codes. For example, they can detect Man-in-the-middle attacks better than SPI firewalls because they look at the content of data packets. They also work better at stopping incoming adware or trojan viruses from malicious websites.
FYI: While a DPI firewall can prevent malware from entering your computer through the internet, it can’t stop malware coming from other sources, like an infected local network device or storage device. For that, you’ll need antivirus software.
On the other hand, SPI firewalls can detect sophisticated attacks like DDoS and even hacking because they look at more than just the data packets. They oversee and monitor the state of active connections, and they can block unsolicited connection requests.
Too bad SPI and DPI firewalls don’t work together, right? Well, hold your horses, because there’s another type of firewall you should know about: Next-gen firewalls, or NGFWs.
Next-Gen Firewalls vs. SPI Firewalls
NGFWs combine the features of SPI firewalls and DPI firewalls. Like SPI firewalls, NGFWs are context-aware. They perform stateful inspections of incoming traffic to detect potentially anomalous connection requests. Additionally, NGFWs inspect the data contained in packets much like DPI firewalls.
NGFWs currently sit at the pinnacle of firewall technology, but because they’re sophisticated, expertise is required to run one. It’s also more expensive, and the cyberthreats it protects against are more common for enterprises and large businesses. So, if you’re looking for a firewall for personal use or for a small business, an SPI or DPI firewall is still the most practical.
Where to Get an SPI Firewall
With everything we’ve discussed, it’s clear that using an SPI firewall is good for your online security. So where can you get one?
If you’re a Windows user, you might not need one, because the Windows Firewall is an SPI firewall. If you’re a Mac or Linux user, though, you’ll probably need to buy from a third-party because Mac’s firewall is application-based and most Linux distributions don’t have a built-in firewall.
Here are some options to get an SPI firewall for your devices:
- A router with SPI firewall: Almost all routers have a built-in firewall, and most of them are stateful. The advantage of using a router with SPI firewall is that it protects your entire network, not just a single device.
- Firewall software: You can also install third-party firewall software on your device. Firewall software is easy to use and configure, but it will likely require an ongoing subscription.
- Antivirus software: The best antiviruses on the market offer a firewall as part of their digital security suites. It’s much like using firewall software, but more practical because the firewall is bundled with the antivirus software.
Pro Tip: The best antiviruses with firewall are Kaspersky, Bitdefender, ESET, and AVG.
Conclusion: Is Having a Firewall Enough?
Deploying an SPI firewall on your network or device is a great way to reduce the attack surface for cyberthreats, but it’s just one facet of your digital security.
Even with a firewall, viruses and malware can still infiltrate your devices, hackers can still get through, and a lot of different attacks that can compromise your online safety can still occur. That’s why for your protection, we recommend using a firewall along with other necessary digital security tools, including VPNs for your online privacy and antivirus software for malware protection.
It’s also important to always practice good digital hygiene, which includes using strong passwords, not clicking on suspicious email attachments, and not giving away personal information online.
If you do all those things, you’ll be able to enjoy a safer and more worry-free online experience.
SPI Firewall FAQs
We answer some of the most frequently asked questions about SPI firewalls and firewalls in general.
-
What are the different types of firewalls?
There are many different types of firewalls, depending on how deep they inspect traffic, what type of traffic they inspect, and how they inspect data packets. SPIs, or stateful firewalls; stateless firewalls; DPIs, or deep packet inspection firewalls; and next-gen firewalls (NGFWs) are just a few examples.
-
Do firewalls protect against malware?
Some types of firewalls offer protection against malware, but only malware that tries to enter your network or device via the internet. Firewalls inspect incoming traffic and data packets to see if they contain malicious codes. However, firewalls can’t protect your devices from malware from other sources, such as another infected computer or storage device.
-
Are SPI firewalls for business use only?
No. Although businesses need a firewall, SPI firewalls are also for personal-use computers, as they aim to protect you from various online threats like DDoS attacks and hacking.
-
Can SPI firewalls prevent hacking?
Yes. SPI firewalls are especially good at preventing hacking. Because SPI firewalls look at the context of traffic flow and not just the content of data packets, they can detect if a connection request is coming from a suspicious source.
-
Are SPI firewalls free?
Most routers have a built-in SPI firewall that you can use for free. Additionally, Windows Firewall is free for Windows users. However, if you use an SPI firewall from a third-party source — for example, a firewall software or antivirus software with a firewall — you’ll likely need to pay a subscription fee.