While doing a Black box pen test via the TCP port (80), you noticed that the traffic gets blocked when you tried to pass IRC traffic from a web enabled host. However, you also noticed that outbound HT

A stateful firewall maintains a state table that records the state of all active network connections, including TCP handshake stages. When outbound HTTP traffic on port 80 initiates a valid TCP session, the stateful firewall permits it and tracks it in the state table. IRC traffic attempting to use the same port would not match an expected HTTP session state and is blocked because it violates the tracked connection context.

An application-layer firewall performs deep packet inspection at Layer 7, but the scenario describes stateful connection tracking rather than full protocol content analysis.

A circuit-level gateway operates at the session layer and validates TCP handshakes, but does not track ongoing connection states to differentiate traffic types on the same port.

A packet-filtering firewall only inspects individual packets based on IP and port rules and has no connection state awareness, so it would allow both HTTP and IRC on port 80 without distinguishing them.