TCP connections

TCP connections cannot be tracked simply by inspecting the ports. For some protocols such as FTP or PPTP, checks of the payload are necessary to open all subsequently negotiated connections, so that only those packets that genuinely belong to the connections are accepted. This is a simpler version of how IP masquerading works, but without address and port mapping. It is sufficient to follow the negotiation, open the appropriate ports and link them with the main connection. This means that these ports are also closed when the main connection is closed, and the data traffic on the secondary connections also keeps the main connection open.