Check Point's patented Stateful Inspection technology relies on maintaining connection information in kernel memory. This information, which includes source/destination IP addresses, ports, and connection state, is stored in data structures known as State tables (or connection tables). When a packet arrives, the firewall checks the state tables to see if it belongs to an existing, legitimate connection. This allows the firewall to pass subsequent packets of an approved connection without re-evaluating each packet against the full rule base, significantly improving performance.

A. SMEM is a kernel memory allocator, not the data structure itself. The state tables reside in memory managed by it, but this is not the most precise answer.

C. While a "session" is tracked, the specific Check Point terminology for the data structure is the "State table" or "connections table".

D. Storing dynamic connection data in a file on a hard drive would be far too slow for a high-performance firewall. State information must be in RAM.

1. Check Point. (2023). R81.20 Security Gateway and Cluster Administration Guide. Page 31, "The Firewall Kernel". States: "The Firewall kernel is a software module that is part of the Gaia operating system. It is responsible for processing all network traffic that passes through the Security Gateway... The Firewall kernel maintains state tables where it stores information about connections."

2. Check Point. (2023). CPR81.20CLIReferenceGuide. Page 1010, "fw tab". The command fw tab -t connections is used to view the kernel table for connections, which is the state table.