During a blackbox pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic is unimpeded. What type of fir

Circuit-level gateways operate at the session layer and validate TCP handshakes, but do not inspect packet contents or application-layer protocols.

Stateful firewalls track connection state and allowed ports/IPs but do not perform deep protocol inspection to distinguish IRC from HTTP on the same port.

Application-layer firewalls (also called proxy firewalls or Layer 7 firewalls) inspect the full payload content of packets to determine the application protocol in use. Because IRC has a distinct protocol signature, the firewall identifies the traffic as IRC - not HTTP - even though it is transmitted over port 80/TCP, and enforces policy based on that protocol identification.

Packet filtering firewalls make decisions based solely on port numbers, source/destination IPs, and protocol flags - they would not block IRC traffic on port 80 if that port is permitted.