japan gave us a new state table logic get rid of that annoying address triple thing! a state key has two addresses, src and dst since src and dst are swapped depending on direction, just address1 and address2 same for ports a state has two state key pointers: wire side and stack side wire as seen on the wire stack after pf is done with it the above of course is exactly swapped when pf is called outbound