Design and Performance of the OpenBSD Stateful Packet Filter (pf)

This paper from Usenix 2002 describes the design of the new OpenBSD packet filter (pf) and compares performance of stateful vs. stateless filtering.