Which characteristic differentiates a transport-layer firewall from a…

Concept

Firewall generations are classified by which OSI layer they inspect and how much connection context they retain. A packet-filtering (stateless) firewall examines each packet in isolation against static header rules — source/destination IP, port, and protocol — with no memory of any earlier packet. A transport-layer (stateful) firewall extends this by also tracking the TCP connection itself: it maintains a state table of open sessions and checks each packet’s TCP flags (SYN, ACK, FIN, RST) against the expected state of that session, so a packet that does not fit an established or properly-initiated connection is rejected even if its header alone looks valid.

Application

Applying this to the four offered characteristics: only "blocking based on TCP flags and connection states" describes connection-context awareness at the transport layer — examining flag sequences (e.g., an ACK or RST that does not correspond to any tracked handshake) in light of a maintained session-state table. A plain packet-filtering firewall has no such state table, so it cannot make this kind of decision; it can only match a single packet’s header fields against a static rule list.

Cross-check

Checking each remaining characteristic against the packet-filtering vs. transport-layer distinction confirms none of them fits that specific boundary:

• Dynamically modifying routing tables is a router/routing-protocol function (e.g., a dynamic routing protocol updating paths), not a capability that separates any class of firewall from another.

• Detecting encrypted traffic is not what distinguishes stateless header-filtering from stateful transport-level tracking — neither firewall type decrypts or classifies payload encryption by itself; that capability, where it exists, belongs to deep-packet-inspection/TLS-inspection tooling.

• Inspecting application payloads is the defining capability of a later, application-layer (proxy/gateway) firewall generation — one tier above the transport-layer firewall being compared here, not the transport-layer firewall itself.

So the characteristic that specifically separates a transport-layer firewall from a packet-filtering firewall is its ability to track TCP connection state and evaluate flags against that tracked state — confirmed by NIST’s guidelines on firewalls, which describe stateful inspection at the transport layer as maintaining a state table of connections, distinct from stateless packet filtering and from application-layer proxying.