What is it?
An Intrusion Detection System (IDS) monitors network traffic (usually via a mirrored/SPAN port, out of the direct path) and generates alerts when it matches known attack signatures or anomalies — it does not block anything itself. An Intrusion Prevention System (IPS) sits inline in the actual traffic path and can actively drop or block malicious traffic in real time.
Why should I learn it?
This is one of the most frequently asked “explain the difference” questions in network security interviews, and the two are commonly confused because they use similar detection logic.
How it works
IDS: traffic is copied to the sensor via SPAN/mirror port → sensor analyses the copy → if malicious, an alert is generated → the original traffic is unaffected (already delivered). IPS: traffic physically passes through the sensor → sensor analyses it in real time → if malicious, the packet is dropped before it reaches the destination → legitimate traffic passes through with added latency.
Real-world example
A company might run an IDS in a testing/monitoring-only rollout to tune signatures and reduce false positives, then switch to IPS mode once confident the rules won’t block legitimate business traffic.
Troubleshooting mindset
If legitimate traffic is being dropped unexpectedly, check whether the sensor is deployed inline (IPS) — a false-positive signature match on an IPS causes outages, while the same false positive on an IDS only causes noisy alerts.
Common mistake
Do not memorise the definition without connecting it to packet flow, device state and verification. Ask: what should happen, what actually happened, and which command or capture can prove the difference?
Quick recap
- Understand the job of the protocol or feature.
- Know where it sits in the traffic path.
- Verify behaviour instead of guessing.
- Connect the topic to the next networking layer.
Interview connection
Explain the concept in simple words first. Then give one practical example or troubleshooting check. That is stronger than repeating a textbook definition.
References & Further Reading
- AddySec original content — written for the Network Security track to build practical, interview-ready understanding.
Apni Bhasha mein samjho
IDS sirf alert deta hai — traffic ko rokta nahi. IPS traffic path mein baitha hota hai, aur malicious traffic ko drop bhi kar sakta hai.
Kaise padho?
Concept ko pehle flow ke saath samjho. Phir English note ke technical terms, commands aur tables dekho — technical terminology same rahegi.