While conducting a penetration test, the tester determines that there is a firewall between the tester's machine and the target machine. The firewall is only monitoring TCP handshaking of packets at t

A packet filtering firewall operates at the network layer (Layer 3) and filters traffic based on source/destination IP addresses and port numbers, not TCP session handshaking.

An application-level firewall (proxy firewall) operates at the application layer (Layer 7) and performs deep inspection of application protocol data, far beyond session handshake monitoring.

Circuit-level gateways function at OSI Layer 5 (session layer) by monitoring the TCP three-way handshake to determine whether a requested session is legitimate, without inspecting the actual data payload. Once a session is established as valid, traffic is relayed without further content inspection. This behavior - validating session establishment rather than filtering by IP or inspecting application data - is the defining characteristic of a circuit-level gateway.

A stateful multilayer inspection firewall tracks connection state across multiple OSI layers simultaneously, including network and application layers, which is more comprehensive than the described behavior.