A firewall is to be configured to allow hosts in a private network to freely…
2007
A firewall is to be configured to allow hosts in a private network to freely open TCP connections and send packets on open connections. However, it will only allow external hosts to send packets on existing open TCP connections or connections that are being opened (by internal hosts) but not allow them to open TCP connections to hosts in the private network. To achieve this the minimum capability of the firewall should be that of
- A.
A combinational circuit
- B.
A finite automaton
- C.
A pushdown automaton with one stack
- D.
A pushdown automaton with two stacks
Attempted by 13 students.
Show answer & explanation
Correct answer: D
Answer: A pushdown automaton with two stacks
Reasoning: The firewall must be able to track the state of TCP connections so it can allow internal hosts to open connections and accept packets only for connections that are being opened by internal hosts or are already established. That requires maintaining a table or bookkeeping of active connection state and associating incoming packets with those connections.
A combinational circuit
has no memory and therefore cannot track connection state.
A finite automaton
only has a fixed finite number of states and cannot store an unbounded or dynamically growing set of connection records.
A pushdown automaton with one stack
can handle nested patterns (stack-like structures) but cannot maintain multiple independent connection entries needed for general connection tracking.
A pushdown automaton with two stacks
is Turing-equivalent and can implement arbitrary bookkeeping (effectively unbounded memory), which is sufficient to track many simultaneous TCP connections and match incoming packets to existing or opening connections.
Therefore, the minimum capability required is a pushdown automaton with two stacks.
A video solution is available for this question — log in and enroll to watch it.