IPS/IDS
IDS/IPS
IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) are network security tools that monitor traffic for malicious activity.
Feature IDS IPSFull Name Intrusion Detection System Intrusion Prevention System
Purpose Detects attacks Detects and stops attacks
Location Monitors traffic passively Sits inline with network traffic
Action Generates alerts Blocks or drops malicious traffic
Impact on Traffic Does not affect traffic flow Can stop traffic automatically
IDS (Intrusion Detection System)
An IDS watches network traffic and alerts administrators when suspicious activity is detected.
Examples of what it detects:
Port scans
Malware activity
Brute-force login attempts
Unusual network behavior
Example: A hacker scans your network looking for open ports.
IDS detects the scan.
IDS sends an alert to the security team.
The attack is not automatically blocked.
Think of IDS as a security camera. It sees suspicious activity and reports it.
IPS (Intrusion Prevention System)
An IPS not only detects attacks but also takes action to prevent them.
Actions an IPS can perform:
Block malicious IP addresses
Drop malicious packets
Reset network connections
Stop exploitation attempts
Example: A hacker sends a known malware payload.
IPS detects the attack signature.
IPS drops the packet.
The attack never reaches the target system.
Think of IPS as a security guard. It sees the threat and immediately stops it.
Detection Methods
1. Signature-Based Detection
Looks for known attack patterns.
Example: Detecting a known ransomware signature.
Pros:
Fast
Accurate for known threats
Cons:
Cannot detect brand-new attacks
2. Anomaly-Based Detection
Looks for unusual behavior.
Example: A user normally downloads 10 MB per day but suddenly downloads 10 GB.
Pros:
Can identify unknown threats
Cons:
More false positives
Network Placement
Plain Text
Internet
|
Firewall
|
IPS
|
Internal Network
``
IPS is typically placed inline so it can block traffic.
Plain Text
Internet
|
Firewall
|
Switch ---- IDS
|
Internal Network
IDS is often connected to a mirrored port and only monitors traffic.
Popular IDS/IPS Solutions
Snort (IDS/IPS)
Suricata (IDS/IPS)
Zeek (formerly Bro) (IDS)
Cisco Secure IPS
Palo Alto Threat Prevention
Fortinet FortiGate IPS
Security+ / CISSP Exam Tip
IDS = Detect and Alert
IPS = Detect, Alert, and Block
A common exam question asks which device actively prevents attacks.
✅ Answer: IPS
Easy Memory Trick
IDS = "I Detect Suspicious"
IPS = "I Prevent Suspicious"
The key difference is that IDS only notifies, while IPS automatically takes action to stop the threat.
 "image title")
Subscribe to our newsletter
Sign up with your email address to receive news and updates.