During a blackbox pen test you attempt to pass IRC traffic over port 80/TCP from a compromised web enabled host. The traffic gets blocked; however, outbound HTTP traffic is unimpeded. What type of fir

An application firewall performs full Layer 7 deep packet inspection and would also differentiate protocols, but the scenario describes protocol-state-level blocking consistent with stateful inspection rather than content-level application proxy filtering.

A circuit-level gateway validates TCP handshake legitimacy at the session layer but does not inspect the application protocol content of the data being transferred, so it would not distinguish IRC from HTTP on the same port.

A stateful firewall maintains connection state tables and monitors whether traffic over a given port conforms to the expected protocol behavior for that port. It can detect that IRC session patterns do not match HTTP state-machine characteristics, blocking the non-HTTP traffic on port 80 while allowing legitimate HTTP through - something a simple packet filter cannot do.

A packet filtering firewall makes permit/deny decisions based solely on IP address, port number, and transport protocol in packet headers, and would allow all port 80/TCP traffic regardless of whether the payload carries HTTP or IRC.