While doing a Black box pen test via the TCP port (80), you noticed that the traffic gets blocked when you tried to pass IRC traffic from a web enabled host. However, you also noticed that outbound…

A stateful firewall maintains a state table of active connections and evaluates packets against the state of existing TCP sessions. Outbound HTTP traffic is permitted because connections are initiated from inside and follow predictable request-response session states that are tracked in the state table. IRC traffic on port 80 is blocked because its persistent, multi-channel connection behavior does not match the expected state of a valid HTTP session being monitored by the firewall.

An application-layer firewall performs Layer 7 deep packet inspection and could also differentiate HTTP from IRC, but the described behavior of allowing outbound sessions based on tracked connection state is the defining characteristic of a stateful firewall.

A circuit-level gateway validates TCP handshakes at the session layer but does not track ongoing connection state or differentiate protocol behavior for traffic using the same port number.

A packet filtering firewall makes decisions based solely on IP addresses, ports, and protocol numbers at Layers 3-4, so it cannot distinguish HTTP from IRC traffic both using port 80.