What are IDS / IPS?
Intrusion Detection and Prevention Systems, told as a story about a watcher holding wanted posters.
Wanted posters hang along the hallway."This face, this bag, this way of talking — report it." Sent by the watchtower friend.
A poster is useless if nobody's looking at it.The thief strolls right past his own poster.
IDS rings the bell; IPS blocks the road.Both compare against the posters. IDS sits to the side and only rings; IPS stands in the path and stops you.
A match rings the bell and drops the barrier.The bell goes to the guard room. The blocked one turns around.
New faces get through; lookalikes get blocked.A new thief has no poster — that's the hallway watcher (NDR)'s job, reading habits. And since IPS blocking a lookalike makes everyone angry, it only uses the surest posters.
IDS / IPS = the watcher who compares everything in the hallway against wanted posters (signatures). IDS rings; IPS blocks.
Intrusion Detection / Prevention System. Snort and Suricata are how the posters get written. Today it's usually built into the wall (a next-gen firewall). The hallway watcher (NDR) reads habits; IDS reads posters.
When grown-ups say it
- Signature
- The wanted poster. What a known attack looks like. → same family as the footprint
- Rule
- One poster. A Snort or Suricata rule — one face per line.
- Intrusion Detection System
- Sit beside, ring the bell. Watches and reports. Never blocks.
- Intrusion Prevention System
- Stand in the path, block. Same posters, different spot. Can block — and can block wrongly.
- Inline
- In the path. Everyone passes the watcher. A slow watcher means a slow hallway.
- TAP / out-of-band
- Sitting beside. Sees a copy only. Never slows anything. → the mirror at the end
- False positive
- Blocking a lookalike. Blocked for the red hat alone. → the guard room's cat
- Next-gen firewall
- A wall with the poster-watcher built in. The wall (firewall) with IPS inside. How it's usually sold today.