A hacker has altered a user's 3-Way Handshake in order to gain access to their session. Which security mechanism would intelligently deny this traffic?

A stateful firewall operates by maintaining a state table that tracks the status of all active network connections. It understands the legitimate sequence of a TCP 3-Way Handshake (SYN, SYN-ACK, ACK). When a hacker attempts to alter this handshake, for instance, by predicting sequence numbers to hijack a session, the stateful firewall detects the anomaly. It recognizes that the malicious packets do not conform to the expected state of the connection in its table (e.g., an incorrect sequence number, a packet arriving out of order). This "intelligent" inspection allows it to deny the malicious traffic and protect the user's session.

A. Out-of-band management (OOBM): This provides a separate, dedicated channel for device administration and management; it does not inspect or filter user data traffic.
B. Stateless firewall: This type of firewall inspects each packet in isolation based on static rules and does not track the state of a connection, making it blind to handshake manipulations.
C. Access Control List (ACL): An ACL is a set of rules used by stateless firewalls to filter traffic based on header information (IP, port), but it lacks the state-tracking capability to validate a TCP session.

1. ArubaOS-CX 10.11 Security Guide

Page 281

"Stateful Firewall" section: "The stateful firewall tracks the state of network connections (such as TCP streams or UDP communication) and makes decisions based on the state of the connection... The firewall maintains a state table that contains information about all active connections." This confirms its ability to track TCP streams and connection states

which is necessary to detect handshake alterations.

2. Aruba Certified Switching Associate (ACSA) Official Certification Study Guide (HPE Press)

Chapter 11: Securing the Network

Page 288: "Stateful firewalls track the state of connections and can make more intelligent decisions about whether to forward or drop traffic... They can ensure that the returning traffic is truly a response to an internal request." This highlights the "intelligent" nature required by the question.

3. Purdue University

ECE 695

"Computer and Network Security" by Avinash Kak

Lecture 13

"Firewalls

" Slide 13-18: "A stateful firewall keeps track of the state of the network connections... For example

with the TCP protocol

a stateful firewall keeps track of the three-way handshake for establishing a connection... A stateful firewall will not allow an incoming packet with the ACK bit set if there was no prior exchange of SYN packets." This academic source explicitly details how a stateful firewall validates the TCP handshake.