IDS / IPS
Systems that detect (IDS) or detect and block (IPS) malicious traffic on a network.
An Intrusion Detection System monitors a copy of traffic passively, deployed out-of-band, and can only generate alerts — it never stops an attack. An Intrusion Prevention System sits inline so it can drop or reset malicious connections before they reach the target. Both apply signature-based detection, which matches known patterns quickly but misses novel threats, and anomaly-based (behavioral) detection, which baselines normal activity and flags deviations to catch zero-days at the cost of more false positives. For N10-009, remember IDS = passive/out-of-band/alerts; IPS = inline/blocks. Unlike a firewall filtering by port and address, an IPS inspects packets against signatures regardless of port.
PlayPrepHQ study notes are written and reviewed against primary exam sources. How we create & review content →