While conducting a penetration test, the tester determines that there is a firewall between the tester's machine and the target machine. The firewall is only monitoring TCP handshaking of packets at t

A packet filtering firewall operates at the Network layer (Layer 3), evaluating individual packets based on IP addresses and port numbers without tracking session state or handshaking.

An application-level proxy firewall operates at the Application layer (Layer 7) and performs deep content inspection of the full data payload, far beyond session handshake validation.

A circuit-level gateway operates at OSI Layer 5 (Session layer) and determines whether a session is legitimate by monitoring TCP handshaking - verifying SYN, SYN-ACK, and ACK exchanges - rather than inspecting application-layer data. Once the handshake is validated, the gateway relays traffic without further content inspection. This session-level operation precisely matches the scenario described where the firewall monitors only TCP handshaking.

A stateful multilayer inspection firewall monitors traffic across multiple OSI layers simultaneously, tracking full connection state and inspecting content beyond the handshake alone.