A method of establishing a connection between a first host system and a second host system through a firewall protecting the second host system, comprising: performing, by a knock-on-feature, KOF, apparatus: receiving a first message sent by the first host system (Ho); determining the first message is of a first type for establishing the connection between the first host system (Ho) and a second host system (Hi); determining respective addresses of the first (Ho) and second hosts systems (Hi) from the first message; determining if any state information exists on the KOF apparatus for a 2-tuple corresponding to the addresses of the first (Ho) and second host systems (Hi); and sending the first message to the second host system if no said state information for the 2-tuple exists on the KOF apparatus, characterised in that the method further comprises the steps of: If no state information for the 2-tuple exists on the KOF apparatus: initializing and starting a first timer for the 2-tuple and initializing and incrementing a message counter for the 2-tuple; if state information for the 2-tuple exists on the KOF apparatus: checking the first timer; removing said state information on the KOF apparatus if the first timer has expired; checking a count of the message counter; if the count has reached a predetermined value and the first timer has not expired, starting a second timer for the 2-tuple and dropping the first message; and sending the first message to the second host system (Hi) if the count has not reached the predetermined value and the first timer has not expired. performing, by a knock-on-feature, KOF, apparatus: receiving a first message sent by the first host system (Ho); determining the first message is of a first type for establishing the connection between the first host system (Ho) and a second host system (Hi); determining respective addresses of the first (Ho) and second hosts systems (Hi) from the first message; determining if any state information exists on the KOF apparatus for a 2-tuple corresponding to the addresses of the first (Ho) and second host systems (Hi); and sending the first message to the second host system if no said state information for the 2-tuple exists on the KOF apparatus, characterised in that the method further comprises the steps of: receiving a first message sent by the first host system (Ho); determining the first message is of a first type for establishing the connection between the first host system (Ho) and a second host system (Hi); determining respective addresses of the first (Ho) and second hosts systems (Hi) from the first message; determining if any state information exists on the KOF apparatus for a 2-tuple corresponding to the addresses of the first (Ho) and second host systems (Hi); and sending the first message to the second host system if no said state information for the 2-tuple exists on the KOF apparatus, characterised in that the method further comprises the steps of: If no state information for the 2-tuple exists on the KOF apparatus: initializing and starting a first timer for the 2-tuple and initializing and incrementing a message counter for the 2-tuple; if state information for the 2-tuple exists on the KOF apparatus: checking the first timer; removing said state information on the KOF apparatus if the first timer has expired; checking a count of the message counter; if the count has reached a predetermined value and the first timer has not expired, starting a second timer for the 2-tuple and dropping the first message; and sending the first message to the second host system (Hi) if the count has not reached the predetermined value and the first timer has not expired.