Which device verifies that packets belong to an established session?

• A. Proxy Server
• B. NAT Gateway
• C. Stateful Inspection Firewall
• D. Load Balancer

Answer: (C)

The main idea here is that some firewalls watch not just individual packets but the context of ongoing connections. A stateful inspection firewall keeps a session/state table and tracks active connections. When a packet arrives, it checks whether that packet belongs to an already established session, using information like IPs, ports, and the TCP state. If it matches an existing connection, it’s allowed; if not, it’s dropped. This per-packet validation of session state helps prevent unsolicited traffic and spoofed packets.

A proxy server sits between client and server and can inspect and filter traffic at the application level, but it doesn’t rely on maintaining a stateful view of every ongoing connection in the same way. A NAT gateway translates addresses and can maintain mapping information for active translations, but its primary job isn’t to verify that each inbound packet belongs to an established session. A load balancer distributes requests across servers and may offer session persistence, but its core role isn’t session-state verification for each packet.