Which component is responsible for maintaining the flow state table for active traffic flows?

In the software-defined networking stack, the planes have very specific, separated duties.

The Management Plane handles user UI/API input, and the Control Plane computes the topology. However, neither of these planes actually touch or inspect the network packets.

The Data Plane (which resides directly in the ESXi hypervisor kernel at the virtual switch/vNIC layer) is the engine that physically moves, inspects, drops, or forwards network traffic. Because the Distributed Firewall is stateful, it must track every active connection (TCP handshakes, sequence numbers, UDP timers) to allow return traffic automatically. This real-time, high-speed tracking occurs exclusively within the Data Plane , which maintains the active Flow State Table in the hypervisor's memory.

=========================