Checkpoint Firewall-1 uses the stateful inspection technology. Checkpoint analyzes all packet communication layers and extracts the relevant communication and application state information. Firewall-1 has an inspection module that lives in the operating system kernel. This is below the network layer at the lowest software level. This is the most ideal location because, by analyzing all traffic at this level, the Inspection Module inspects all traffic before they reach the OS. This saves the OS’s processing time and resources. Also, a final note, by placing its kernel module between the Network Interface Cards and the TCP/IP stack itself, Firewall-1 protects the TCP/IP stack.