Packet induced revalidation of connection tracker

A non-transitory machine readable medium storing a program which when executed by at least one processing unit uses packets to validate entries in a connection tracking table of a firewall engine executing on a host computer, the firewall engine using a firewall rule storage storing a set of firewall rules and using the connection tracking table to track data flows to which the firewall engine has applied firewall rules, the program comprising sets of instructions for:

• receiving a packet that is part of a particular flow;
• when the connection tracking table has an entry matching the particular flow:
• retrieving, from the matching entry in the connection tracking table, a set of data stored for an associated flow for which the entry was created in the connection tracking table and for a firewall rule that was previously applied to the flow for which the entry was created;
• identifying a firewall rule in the firewall rule storage that matches the associated flow for which the entry in the connection tracking table was created;
• and
• when the identified firewall rule comprises an associated set of data that does not match the set of data retrieved from the connection tracking table, updating the connection tracking table based on the identified firewall rule's set of data.