Update notes.md

config/network/notes.md

@@ -66,32 +66,25 @@ breadcrumbs:
 
 ### L4 Firewalls
 
-- Called stateful if it provides connection tracking for TCP/UDP traffic.
 - NAT:
   - Universal Plug and Play (UPnP), NAT Port Mapping Protocol (NAT-PMP), Port Control Protocol (PCP), Session Traversal Utilities for NAT (STUN), etc. can function as attack vectors as an adversarial program may be able to exploit it to allow external connections to internal devices. It should generally be turned off except if explicitly needed. It's typically used by multiplayer games and other peer-to-peer applications.
 
 ### L7 Firewalls
 
-- A.k.a. next-generation firewall (NGFW).
-- Based on deep packet inspection (DPI).
-- Can be extended to include:
-  - IDS/IPS functionality.
-  - User identity management for network traffic.
-  - Web application firewall (WAF).
-
-### Intrusion Detection Systems (IDS)
-
-- Called intrusion *prevention* system (IPS or IDP) if it can block traffic after a detected threat.
+### Intrusion Detection Systems (IDSes)
 
 ## Informative Notes
 
-### Routers and Firewalls
+### Firewalls and Intrusion Detection Systems (IDSes)
 
+- Stateful firewall: Provides connection tracking for TCP/UDP traffic.
 - Network address translation (NAT):
   - Mainly done in firewalls but also in some routers.
   - Many different types, including masquerading with port forwarding.
   - Hairpinning/reflection: Reroute internal requests from a NATed network to an edge router's external IP address back into the router. It allows using domain names with public IP addresses from within the NATed network.
   - Greatly reduced the rate of IPv4 address exhaustion at the cost of breaking the end-to-end principle, which introduced many new problems.
   - Generally avoided in IPv6. Network prefix translation (NPT), however, can be used to translate (highly) dynamic global prefixes to static site-local prefixes.
+- Layer 7 firewalls: Provides deep packet inspection (DPI). A.k.a. next-generation firewalls (NGFW). Provides a foundation for IDS/IPS, user identity management and web application firewalls (WAF).
+- Intrusion prevention systemes (IPSes or IDPs): Can block traffic once a threat has been identified, unlike a plain IDS.
 
 {% include footer.md %}