IDS / IPS
intrusion detection & preventionAn IDS/IPS watches network traffic for signs of attack. It inspects packets against known signatures and behaviour, raises an alert on a match, and can drop the traffic inline — the network’s alarm, and sometimes its reflex.
An IDS watches for attacks and alerts; an IPS sits inline and blocks them.
How it works
& behaviour
Every packet is compared against attack signatures and normal-behaviour models. An IDS sits out of band and alerts; an IPS sits inline and can drop the malicious flow before it reaches its target.
What an IDS / IPS does, step by step
It sits inline, or receives a mirrored copy of the traffic.
It compares packets against signatures and anomaly models.
A signature match or a behavioural outlier is flagged.
An IDS notifies; an IPS drops the flow inline.
In cybersecurity
The IDS/IPS is the network’s eyes — its value is only as current as its signatures and tuning.
Stale rules miss the newest attacks.
Catches the unknown — at the cost of false positives.
An IPS in the path can also block good traffic.
It can’t read TLS without decryption.
Noise buries the real alerts.
Its alerts flow to monitoring and response.