An intrusion detection system (IDS) is a monitoring system that passively monitors incoming and outgoing network traffic for suspicious attacker activity. An IDS is a module that can alert network devices, but it cannot stop attacks from happening. Generally, an IDS is configured in promiscuous mode because it cannot block the attacks, but only send alerts:
One major question you may have is how different is an IPS from a firewall that can also do deep-packet inspection? Well, the answer is that an IPS can identify traffic patterns that might match an attack, while a firewall can do an inspection on a per-packet basis, thereby they would not be intelligent enough to detect an attack. So, in any secure network, an IPS complements a firewall.
The different IPS and IDS identification methods are discussed here:
- Signature-based: The IPS verifies the...