While doing a Black box pen test via the TCP port (80), you noticed that the traffic gets blocked when you tried to pass IRC traffic from a web enabled host. However, you also noticed that outbound HT

A stateful firewall maintains a connection state table and monitors each session's protocol behavior throughout its lifecycle. When IRC traffic is sent over port 80, the firewall detects that the traffic does not conform to expected HTTP state patterns for that connection, and blocks it. Outbound HTTP is permitted because the firewall validates it as a properly initiated, state-tracked HTTP session.

An application-layer firewall performs deep payload inspection of the data itself to enforce protocol rules, which is a more advanced and distinct function than state tracking.

A circuit-level gateway only validates that the initial TCP handshake is legitimate and does not inspect ongoing traffic state or protocol conformance beyond session establishment.

A packet filtering firewall examines only static header fields like source/destination IP and port number, and cannot distinguish IRC from HTTP when both use port 80.