In firewall connection tracking, especially on MikroTik devices using RouterOS, you may find that some connections do not have a specific TCP State listed.

This is generally because these connections are not TCP type. Connection tracking in a firewall is not limited to TCP connections; It also tracks other types of traffic such as UDP, ICMP, and more, which do not use the connection-oriented model and defined states that TCP employs.

The TCP protocol is known to have a connection establishment and termination process that involves various states (such as SYN_SENT, ESTABLISHED, FIN_WAIT, etc.). These states allow detailed tracking of the life cycle of a TCP connection.

On the other hand, protocols such as UDP (User Datagram Protocol) y ICMP (Internet Control Message Protocol) are examples of protocols that do not establish a state-oriented connection in the same way as TCP. Therefore, they do not have “TCP states” as such.

• For UDP traffic, which is connectionless, no connection establishment or termination process is expected, so the concept of connection state, in the TCP sense, does not apply. However, the firewall can still track UDP sessions by the combination of source and destination IP address and port numbers, but these will not be registered with specific TCP states.
• For ICMP traffic, which is primarily used to send error or control messages (such as those used by the ping command), also does not apply the concept of TCP connection status.

In summary, if an entry in your firewall's connection trace does not show a TCP state, it likely represents non-TCP traffic and therefore does not apply the connection state model that TCP uses.

To manage and understand this traffic, other aspects of connection tracking are considered, such as protocol types, source and destination addresses, and ports involved.