A network engineer is documenting the OSI layers at which each security appliance operates. She needs to identify the device that inspects traffic based on the state of active connections, tracking whether a packet is part of an established session before permitting it. At which OSI layer does a traditional stateful firewall primarily make these filtering decisions?