IDS vs IPS
Definition
An intrusion detection system observes copied traffic and alerts. An intrusion prevention system sits inline on the data path and blocks. Snort and Suricata operate as either; Zeek (formerly Bro) is a flow-analysis engine that is detection-only.
- IDS behaviour
- Monitors copied traffic, generates alerts only
- IPS behaviour
- Sits inline, can block traffic in real time
- Dual-mode tools
- Snort and Suricata can run as either
- Detection-only tool
- Zeek (formerly Bro), a flow-analysis engine
- Placement
- IDS off a tap or span port; IPS in the data path
Common questions
Why would an analyst choose IDS mode over IPS mode for the same tool?+
IPS mode risks blocking legitimate traffic if a rule fires on a false positive, which can disrupt production systems. Analysts sometimes run new rule sets in IDS mode first to observe alert volume and accuracy before switching them to inline blocking.
Why is Zeek described as detection-only rather than dual-mode like Snort?+
Zeek is built as a flow and protocol analysis engine that logs and scripts against observed traffic; it was not designed with an inline blocking data path the way Snort and Suricata were. Analysts typically pair Zeek's rich logs with a separate inline IPS for active blocking.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- IPSec AH and ESP
- Authentication Header provides integrity and origin authentication only. Encapsulating Security Payload provides confidentiality plus optional integrity. Almost all modern IPSec deployments use...
- Kerberos
- An MIT-designed authentication protocol using a Key Distribution Centre, ticket-granting tickets and service tickets. The backbone of Active Directory authentication. Replay-protected via...
- NGFW
- Next-generation firewall: stateful packet inspection plus application identification, integrated IPS, TLS inspection and user-identity awareness. Palo Alto, Fortinet, Check Point and Cisco...
- Stateful Firewall
- A firewall that tracks the state of TCP connections in a connection table and permits return traffic of an established flow without...