Re: What are the differences between and IPS and IDS?

[Matt Kettler <mkettler () evi-inc com>]

At 03:41 PM 10/1/2003, Chhabria, Kavita - Apogent wrote:
> Please provide me with the differences and advantages and disadvantages of 
> each approach?

In short, an IPS actively blocks packets which appear to be a part of an 
attack. It's behavior is a bit like a firewall in that respect, but it 
inspects application layer data instead of header-layer data. It should 
however be noted that an IPS is NOT a firewall replacement.

An IDS notes that an offending packet occurred, but does nothing other than 
log the event.

An IPS has the advantage of actively preventing attacks, but has the 
drawback of reducing network throughput (each packet has to be inspected 
before it is passed on) and also possibly blocking legitimate traffic.

An IDS doesn't slow down the rate of data flowing into your network, since 
it's merely a tap and network data doesn't go through it, but has the 
drawback of only telling you about attacks after the fact.



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users