Editing Buffer overflow (section)

===Deep packet inspection===
{{Main|Deep packet inspection}}

The use of deep packet inspection (DPI) can detect, at the network perimeter, very basic remote attempts to exploit buffer overflows by use of attack signatures and [[heuristic (computer science)|heuristics]]. This technique can block packets that have the signature of a known attack. It was formerly used in situations in which a long series of No-Operation instructions (known as a NOP-sled) was detected and the location of the exploit's [[payload (software)|payload]] was slightly variable.

Packet scanning is not an effective method since it can only prevent known attacks and there are many ways that a NOP-sled can be encoded. [[Shellcode]] used by attackers can be made [[alphanumeric]], [[metamorphic code|metamorphic]], or [[self-modifying code|self-modifying]] to evade detection by heuristic packet scanners and [[intrusion detection system]]s.