What capability allows a firewall to analyze the actual application or protocol behind traffic on a given port?

What capability allows a firewall to analyze the actual application or protocol behind traffic on a given port?

• A. Deep packet inspection
• B. Port filtering
• C. NAT
• D. Stateful inspection

Answer: (A)

Deep packet inspection is the ability of a firewall to examine the payload of packets, not just the headers, to identify the actual application or protocol being used behind a given port. Ports can be misleading—different applications can ride over the same port or a protocol can be hidden inside encrypted traffic—so looking inside the packet lets the firewall enforce rules based on the real application, such as HTTP, FTP, or a custom protocol. This goes beyond simply allowing or denying traffic by port numbers, which is vulnerable to port masking or misuse. NAT, on the other hand, translates addresses and doesn’t determine the application. Stateful inspection tracks the state of connections but doesn’t routinely decode payloads to recognize the application protocol. So the capability that best fits analyzing the real application or protocol is deep packet inspection.

Deep packet inspection is the ability of a firewall to examine the payload of packets, not just the headers, to identify the actual application or protocol being used behind a given port. Ports can be misleading—different applications can ride over the same port or a protocol can be hidden inside encrypted traffic—so looking inside the packet lets the firewall enforce rules based on the real application, such as HTTP, FTP, or a custom protocol. This goes beyond simply allowing or denying traffic by port numbers, which is vulnerable to port masking or misuse. NAT, on the other hand, translates addresses and doesn’t determine the application. Stateful inspection tracks the state of connections but doesn’t routinely decode payloads to recognize the application protocol. So the capability that best fits analyzing the real application or protocol is deep packet inspection.