GATE CS 2011 Q2 — Concept of Layering: OSI and TCP/IP Protocol Stacks

A Layer-4 firewall can inspect protocol headers up to the Transport Layer (Layer 4). This means it can examine:

• Layer 3 (Network Layer) information: Source and Destination IP addresses, Protocol type (TCP, UDP, ICMP, etc.).
• Layer 4 (Transport Layer) information: Source and Destination Port numbers, TCP flags (SYN, ACK, FIN, etc.).

Let's analyze each option to see what a Layer-4 firewall can or cannot do:

• Option A (Can do): HTTP traffic typically uses TCP port 80. Since a Layer-4 firewall can inspect port numbers, it can identify and block traffic destined for port 80. Time-based filtering is a standard system management feature supported by firewalls.
• Option B (Can do): ICMP is a Network Layer (Layer 3) protocol. Since a Layer-4 firewall can inspect up to Layer 4, it can easily identify the protocol field in the IP header and block all ICMP traffic.
• Option C (Can do): By performing stateful packet inspection or checking TCP flags (such as blocking incoming SYN packets from a specific IP while allowing outgoing SYN packets to that IP), the firewall can block incoming traffic while allowing outgoing traffic.
• Option D (Cannot do): On a multi-user system, all users share the same IP address. The Layer-4 firewall only sees the IP address and dynamically allocated TCP port numbers; it has no visibility into the operating system's user-to-process mapping (which requires Application-Layer or User-Identity awareness). Thus, it cannot distinguish which packet belongs to which specific user.

Therefore, a Layer-4 firewall cannot block TCP traffic from a specific user on a multi-user system.