What Is an IDS/IPS?
On this page
An IDS detects suspicious network activity and raises alerts; an IPS goes further and blocks it. Together they are how a network gains eyes and, optionally, reflexes — spotting the scans, exploits, and lateral movement that a firewall’s allow/deny rules miss. The difference between them is whether they merely watch or actively intervene.
IDS vs IPS#
| IDS | IPS | |
|---|---|---|
| Position | Out of band (a copy of traffic) | In line (traffic flows through it) |
| Action | Alerts only | Blocks/drops malicious traffic |
| Risk | Misses nothing, stops nothing | A false positive can block good traffic |
| Role | Visibility | Prevention |
The trade-off is real: an IPS that blocks is powerful but risks dropping legitimate traffic on a false positive; an IDS never breaks anything but relies on someone acting on its alerts.
Signature vs anomaly detection#
Both an IDS and IPS decide what is “suspicious” in one of two ways:
- Signature-based — match known-bad patterns. Precise against known threats, blind to new ones.
- Anomaly-based — flag deviations from a learned baseline. Catches novel attacks, but noisier.
Mature deployments blend the two, and feed alerts into a SIEM so they are correlated rather than lost.
IDS/IPS are core network detection tools, feeding the broader detection engineering effort. More at the Network Security hub.
Frequently asked questions#
What is the difference between an IDS and an IPS?
An Intrusion Detection System (IDS) monitors traffic and raises alerts on suspicious activity, but does not block it — it sits out of band. An Intrusion Prevention System (IPS) sits in line with traffic and can actively block or drop malicious packets. IDS observes and warns; IPS observes and acts.
What is the difference between signature and anomaly detection?
Signature-based detection matches traffic against known-bad patterns — effective against known threats but blind to novel ones. Anomaly-based detection builds a baseline of normal behavior and flags deviations, catching new attacks but generating more false positives. Modern systems combine both approaches.