A retailer is comparing a new next-generation firewall with the older stateful firewall already in the store. What does the next-generation firewall add that the older one does not already provide?

A stateful firewall already records the connection: addresses, ports, protocol, and allow or deny. A next-generation firewall adds identification of the application on that connection and a threat verdict, such as a match against known malicious traffic, instead of stopping at the socket. That addition is: Application identity plus a threat verdict on the flow, beyond merely tracking the connection. Repeating the old fields is not an addition. The same 5-tuple the store's older stateful firewall already recorded for each connection was available before the new device arrived. Mail is a separate control path. A full substitute for email filtering, letting this store retire every dedicated mail control overclaims what application identification does. Message sender, recipient, and attachment verdicts still belong to an email filter. Keeping every packet is a capture job. Retention of full packets for every flow, using the firewall itself as the capture platform is not the feature that separates the next-generation verdict from the older connection log. A firewall can inspect traffic in flight without archiving every byte of every flow. Exam caveat: next-generation in this comparison means application identity and a threat verdict on the connection. It does not absorb every other control, and it is not defined as a full-packet archive. Operational check: compare one flow in both logs. The older log shows the 5-tuple and the allow. The newer log adds the application name and a threat verdict.