Problem
Consider an example of a stateful inspection firewall that sees and allows one item, sees and allows another, and so on, until a critical number of items or some other condition indicates that the traffic stream is harmful and should be blocked. Is there any potential harm in admitting the initial pieces up to the point of determining the stream is harmful? Justify your answer. Suppose instead that the firewall quarantined possibly harmful traffic until having enough data to determine whether the stream should be blocked or admitted. List the advantages and disadvantages of quarantining potentially bad data.