If your company uses D-Link routers, then you or your IT consultant may have noticed the ability to enable or disable "SPI mode." This stands for "stateful packet inspection," a security measure employed by hardware firewalls like D-Link routers to defend a computer network from unfamiliar and potentially hazardous data. This additional layer of security may prove invaluable to your business if your network is integral to operations or contains sensitive information.


Firewalls are designed to limit data passage through the firewall and defend the host system against unauthorized users. Routers like those produced by D-Link are a hardware based firewall, limiting traffic and forcing it to pass through the router before entering into the network. Only authorized traffic can pass through a firewall, making it an effective line of defense in network security.

Stateful Packet Inspection

SPI is a security system for filtering the data "packets" transmitted to the data network. Parcels of data transmitted over a network are referred to as "packets," which SPI inspects to distinguish legitimate packets from others. SPI filters packets by checking them against a known, trusted active connection. Packets from unfamiliar connections are rejected, even if they are completely benign. SPI is sometimes also referred to as dynamic packet filtering.

Packet Filtering

Standard – or "stateless" – firewalls also examine data packets, but use far less rigorous criteria to verify the packet. Stateless firewalls only check the header of the packet for identification, and if the header contains credentials on the "allowed" list, the packet is allowed into the network. SPI inspects a packet more thoroughly, inspecting not only the header but also the port address, IP address, sequence number and acknowledgment code on each data packet. This comprehensive examination can identify packets that may pass the header check of a stateless firewall but still be suspect under further scrutiny.


The purpose of SPI is to secure a network against intrusion by unauthorized users via network connections and transmitted data. Unauthorized access to your business network can have several very negative consequences, including data and bandwidth theft or viral attack. Defending your network access points is critical in defending against intrusion, and utilizing SPI can greatly increase security by limiting what packets are allowed access to your network.


Most D-Link routers feature SPI mode, but do not come with it enabled by default. You'll need to enter the router's settings menu in order to enable SPI mode. While it's best if you keep SPI enabled at all times, you'll want to make a port allowance for programs that require peer-to-peer communications to function. Otherwise, SPI mode may interfere with data transmission over these programs.

Photo Credits

  • Stockbyte/Stockbyte/Getty Images