Traditional firewalls only inspect individual packet headers and cannot identify malicious payloads assembled across multiple legitimate packets; this was not improved until intrusion detection systems introduced the concept of session tracking.