signatures

Author: llpeterson

firewall.rst

@@ -471,10 +471,11 @@ published in 1999, having started life as an IDS, and now owned by
 Cisco. In its original incarnation, Snort provided a lightweight,
 rule-based packet filtering and capture tool based on Berkeley Packet
 Filters. The idea is that attacks, such as worms, have a recognizable
-signature (a particular combination of header fields), and that the
-IDS can be programmed with a rule to recognize the attack traffic, and
-raise alerts when this happens. As an IPS, Snort now takes the
-additional step of blocking the attack.
+signature—for example, a particular combination of header values or a
+unique byte-string embedded in the payload—and that the IDS can be
+programmed with a rule to recognize the attack traffic, and raise
+alerts when this happens. As an IPS, Snort now takes the additional
+step of blocking the attack.
 
 .. admonition:: Further Reading
 
@@ -548,7 +549,7 @@ typically involve an adversary trying to overwhelm "good" resources
 with traffic generated by "bad" resources (botnets constructed from a
 distributed collection of compromised devices). Firewalls and other
 security appliances help protect devices from being compromised in the
-first place, but because they are not perfect (a human is usually the
+first place, but because they are not perfect (a human is often the
 weakest link), we also need ways to mitigate the impact of
 *Distributed DoS (DDoS)* attacks.
 
@@ -569,26 +570,25 @@ widely-distributed servers. As long as the aggregate capacity of these
 servers is greater than the aggregate capacity of the botnet—and the
 CDN does a good job spreading requests across the available
 servers—content remains available. This notion of *aggregate* capacity
-generalizes beyond web servers responding to GET requests. A network
-is itself a distributed collection of forwarding and transmission
-resources, engineered to distribute those resources in a way that
-avoids vulnerable bottlenecks.
+generalizes beyond web servers responding to HTTP GET requests. A
+network is itself a distributed collection of forwarding and
+transmission resources, engineered to distribute those resources in a
+way that avoids vulnerable bottlenecks.
 
 The second countermeasure is to filter malicious traffic as early
-(close to the source) as possible. This is similar to what an IPS
-would do, except the traffic often looks legitimate. If a DoS attack
-comes from a single source, then it is easy to "block" traffic from
-that source at an ingress to a network you control. This is why DoS
-attacks are typically distributed.  Dropping (or rate limiting) attack
-packets at the boundary router (or firewall) for an enterprise is
-better than allowing those packets to flood the local network and
-reach a victim server(s), but the more widely distributed the periphery
-of your network, the earlier you can filter malicious packets. And
-drawing on the first countermeasure, the more widely distributed your
-network resources are, the greater your aggregate filtering capacity.
-Global overlay networks, as provided by companies like Cloudflare and
-Fastly, offer a combination of content distribution and distributed
-packet filtering.  These are commercial products, with many
-proprietary details, but the general principles outlined here explain
-their underlying strategy.
+(close to the source) as possible. If a DoS attack comes from a single
+source, then it is easy to "block" traffic from that source at an
+ingress to a network you control. This is why DoS attacks are
+typically distributed.  Dropping (or rate limiting) attack packets at
+the boundary router (or firewall) for an enterprise is better than
+allowing those packets to flood the local network and reach a victim
+server(s), but the more widely distributed the periphery of your
+network, the earlier you can filter malicious packets. And drawing on
+the first countermeasure, the more widely distributed your network
+resources are, the greater your aggregate filtering capacity.  Global
+overlay networks, as provided by companies like Cloudflare and Fastly,
+offer a combination of content distribution and distributed packet
+filtering.  These are commercial products, with many proprietary
+details, but the general principles outlined here explain their
+underlying strategy.