A next-generation firewall is best suited to block or allow traffic based on the actual application being used rather than only the port number. Traditional firewalls commonly rely on IP addresses, protocols, and ports, which is insufficient when many applications use common ports such as TCP 80 or TCP 443. A next-generation firewall adds application awareness, allowing it to identify traffic based on application behavior and enforce more precise security policy. A hub operates at OSI Layer 1 and simply repeats signals; it cannot inspect applications. A DHCP server assigns IP configuration information to clients and does not enforce application-based security policy. A Layer 2 switch forwards frames based on MAC addresses and does not determine whether a specific application should be allowed. Application-aware policy is important because attackers and risky applications often hide within allowed ports. NGFWs help security teams control traffic according to business intent, application risk, user identity, and threat context. Reference/topics: Network Security, stateful firewalls, next-generation firewalls, application awareness.