Explain like I'm five · Security

What are IDS / IPS?

Intrusion Detection and Prevention Systems, told as a story about a watcher holding wanted posters.

WANTEDWANTEDWANTEDWANTED'this face, this bag, this way of talking — report it'

Wanted posters hang along the hallway."This face, this bag, this way of talking — report it." Sent by the watchtower friend.

WANTEDsame face…nobody's lookingthe thief walks right past his own poster

A poster is useless if nobody's looking at it.The thief strolls right past his own poster.

IDSsits beside, rings a belllets him pass, tells the guard roomIPSstands in the path, blocksblocks the road, sends him back

IDS rings the bell; IPS blocks the road.Both compare against the posters. IDS sits to the side and only rings; IPS stands in the path and stops you.

Wanted postersfaces of known thieves
The bellIDS — tells the guard room
The barrierIPS — sends them back
Beside vs. in the pathbeside never slows you; in the path can stop you
WANTEDmatchguard roomblockedthe bell goes to the guard room; the person goes back

A match rings the bell and drops the barrier.The bell goes to the guard room. The blocked one turns around.

WANTEDa new face, no posterthat one's for the hallway watcher, who reads habitsWANTEDI just like red hats!a lookalike got blockedso IPS only uses the surest posters

New faces get through; lookalikes get blocked.A new thief has no poster — that's the hallway watcher (NDR)'s job, reading habits. And since IPS blocking a lookalike makes everyone angry, it only uses the surest posters.

In one breath

IDS / IPS = the watcher who compares everything in the hallway against wanted posters (signatures). IDS rings; IPS blocks.

Intrusion Detection / Prevention System. Snort and Suricata are how the posters get written. Today it's usually built into the wall (a next-gen firewall). The hallway watcher (NDR) reads habits; IDS reads posters.

When grown-ups say it

Signature
The wanted poster. What a known attack looks like. → same family as the footprint
Rule
One poster. A Snort or Suricata rule — one face per line.
Intrusion Detection System
Sit beside, ring the bell. Watches and reports. Never blocks.
Intrusion Prevention System
Stand in the path, block. Same posters, different spot. Can block — and can block wrongly.
Inline
In the path. Everyone passes the watcher. A slow watcher means a slow hallway.
TAP / out-of-band
Sitting beside. Sees a copy only. Never slows anything. → the mirror at the end
False positive
Blocking a lookalike. Blocked for the red hat alone. → the guard room's cat
Next-gen firewall
A wall with the poster-watcher built in. The wall (firewall) with IPS inside. How it's usually sold today.
Next story
The Wall with Many Doors →
Want another term as a picture book? Request →