An IDS (Intrusion Detection System) monitors network traffic or host activity for signs of malicious behaviour and raises alerts. An IPS (Intrusion Prevention System) does the same but sits in the traffic path, so it can drop packets or reset connections automatically.
Why it matters
A firewall decides who may connect; it does not judge what is inside permitted traffic. IDS and IPS tools inspect that content using known signatures, protocol anomaly checks or behavioural baselines. Detection gives defenders visibility and evidence, while prevention shortens the time between an attack starting and being stopped.
Example
A network sensor sees a burst of requests containing a known exploit pattern aimed at an internal web server. An IDS logs an alert to the security team. An IPS in the same position drops those packets and records the event, so the request never reaches the server.
Common mistakes
- Deploying an IPS in blocking mode on day one without tuning. False positives can block legitimate customers or internal tools.
- Ignoring alerts because volume is high. Untuned rules create noise that hides real incidents.
- Assuming encrypted traffic is covered. Without TLS inspection or host-based sensors, a network device cannot read the payload.
- Never updating signatures, which leaves new attack patterns undetected.
Related
Get notified when this term updates
Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.
This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.