"Stateful" differs from "Static" packet filtering firewalls by being aware of which of the following?

Stateful firewalls maintain a connection state table that tracks TCP/UDP session states (e.g., SYN, ESTABLISHED, FIN), allowing them to differentiate between a packet initiating a new connection and one belonging to an already-established session. This enables the firewall to permit return traffic for legitimate outbound connections without requiring explicit inbound rules, which static/stateless filters cannot do since they inspect each packet independently without context.

Awareness of originating network location (IP address-based filtering) is a capability shared by both static and stateful firewalls and is not the distinguishing characteristic of stateful inspection.

Inspecting packet payloads for malicious content is a feature of deep packet inspection (DPI) or Next-Generation Firewalls (NGFW), not a defining characteristic of stateful firewalls versus static packet filters.

Application session awareness is a feature of application-layer (Layer 7) firewalls or proxies, which operate above the transport layer where stateful inspection primarily functions; stateful firewalls track connection state at the network/transport layer, not application sessions.