Best bet: Use an application layer firewall whenever possible – An application layer firewall will perform as well as the stateful firewall, with the added benefit that it will be able to inspect each packet to determine if it really is what it claims to be. For example, if a malicious user sends a packet using port 5060, knowing that the firewall allows such ports to pass, the application layer firewall will inspect the payload of the packet to determine if the SIP protocol is really being used, or if another protocol is being concealed within it.