Stateful-filtering is not used. X-DecoyHost header may be used to bypass filtering.
vulners.com/securityvulns/securityvulns:doc:18888
vulners.com/securityvulns/securityvulns:doc:20314