| Type | Inspects | State |
|---|
| Packet filter | Headers | No |
| Stateful | Connection state | Yes |
| Application (L7) | Deep content | Yes |
| NGFW | App+User+IPS | Yes |
WAF = web app specific. NGFW = network perimeter with app awareness. Stateful is the minimum for enterprise. Packet filter is too basic. The more layers inspected, the more processing overhead.