36 votes 36 votes A firewall is to be configured to allow hosts in a private network to freely open TCP connections and send packets on open connections. However, it will only allow external hosts to send packets on existing open TCP connections or connections that are being opened (by internal hosts) but not allow them to open TCP connections to hosts in the private network. To achieve this the minimum capability of the firewall should be that of A combinational circuit A finite automaton A pushdown automaton with one stack A pushdown automaton with two stacks Computer Networks gateit-2007 computer-networks theory-of-computation normal network-security out-of-gate-syllabus + – Ishrat Jahan asked Oct 29, 2014 Ishrat Jahan 6.3k views answer comment Share Follow See 1 comment See all 1 1 comment reply Sumit1311 commented Nov 17, 2016 reply Follow Share It is not PDA+1 but PDA with one/two stacks. makes sense? 1 votes 1 votes Please log in or register to add a comment.
Best answer 63 votes 63 votes A combinational circuit$\Rightarrow$ Not possible, because we need memory in Firewall, Combinational ckt has none. A finite automaton$\Rightarrow$ We need infinite memory, there is no upper limit on Number of TCP ckt so Not this. A pushdown automaton with one stack$\Rightarrow$ Stack is infinite. Suppose we have $2$ connections, we have pushed details of those on stack we can not access the details of connection which was pushed first, without popping it off. So, Big NO. A pushdown automaton with two stacks$\Rightarrow$ This is TM. It can do everything our normal computer can do so Yes. A firewall can be created out of TM. Correct Answer: $D$ Akash Kanase answered Dec 18, 2015 edited May 18, 2019 by Naveen Kumar 3 Akash Kanase comment Share Follow See all 13 Comments See all 13 13 Comments reply Show 10 previous comments Matrix commented Dec 13, 2018 reply Follow Share @ Rishabh Gupta 2 If we block syn packet from outside wouldn't it also block SYN + ACK packet required during 3 way handshake in connection establishment phase ? 3 votes 3 votes zeeshanmohnavi commented Dec 22, 2018 reply Follow Share @Akash Kanase You arguments make sense, but since the question mentions the word minimum, I think option $(C)$ could be correct as well if we assume that the TCP connections are accessed in the opposite order in which they are opened. Comments? 0 votes 0 votes KartikGawande commented Sep 25, 2022 reply Follow Share Markzuck by “pda with one stack” we dont mean “pda with one additional stack” we mean “pda consisting of one stack” 0 votes 0 votes Please log in or register to add a comment.
5 votes 5 votes It should be D as it is equal to turing machine and since we need to keep track of all the open connections as they should only be connected with outside world(one to one matching) a PDA won't suffice.. Marv Patel answered Dec 31, 2014 Marv Patel comment Share Follow See 1 comment See all 1 1 comment reply Vicky Bajoria commented Jan 8, 2015 reply Follow Share Answer should be (D) It can be done by finite state machine only if it is allowed only one host to open connection at a time, becuase when the replying packet will come back, then NAT (network address translator) very much knowing who has asked for the packet.. but since more than one host can open connection simultaneously, so memory requirement may not be finite because we don't know how many host in the private network has asked for the network.. So it does require some memory capability.. And as per the options we have to use stack as the memory.. We will be requring two stack, because when a external packets coems as a reply then firewall pop each of the requiesting packet to see, who has ordred the packet and keep on pushing on the another stack, and once it is found, he forwards it to the requesting host.. else if not found the packet is discarded.. 15 votes 15 votes Please log in or register to add a comment.
0 votes 0 votes pushdown automata with two stacks which is the Turing machine. Turing machine can do everything as the normal computer can do, so firewall can be created by the TM. Utkarsh Pathak answered Nov 9, 2020 Utkarsh Pathak comment Share Follow See all 0 reply Please log in or register to add a comment.