Intrusion Prevention System (IPS): How It Works, Types, and IDS vs IPS

An intrusion prevention system (IPS) is a security device or software that sits inline in the traffic path, inspects every packet or flow, and blocks traffic it judges malicious before it reaches its target. An intrusion detection system (IDS) does the same inspection from outside the path, on a copy of the traffic, and can only raise alerts. In short: an IDS tells you about an attack, an IPS stops it. A network-based IPS (NIPS) is the most common form, placed at the network edge or between network segments.

What is an IPS in networking?

An IPS combines two jobs: intrusion detection (spotting attacks in traffic or on a host) and an automatic response (dropping, resetting or blocking). NIST’s guide to the subject, SP 800-94 (2007), treats the two together as intrusion detection and prevention systems (IDPS), because most products can run in either mode. What makes a system an IPS rather than an IDS is its position: it must be inline, so traffic physically passes through it and it can refuse to forward a packet.

Where an IPS sits in the network

Picture a typical enterprise edge from left to right:

Internet → router → firewall → IPS (inline) → core switch → internal servers and users

• The firewall first drops traffic that breaks basic rules (wrong ports, addresses or protocols).
• The IPS then inspects what the firewall allowed through, looking inside the packets for exploits, malware and protocol abuse.
• An IDS, by contrast, would hang off a switch SPAN port or network tap, receiving a copy of the traffic. It sees everything but cannot stop anything on its own.

IPS sensors are also placed between internal zones, for example in front of a data centre or between the office network and industrial control systems, to catch attacks that spread sideways.

Fail-open vs fail-closed

Because an inline IPS is in the path, its failure affects traffic. A fail-open design (often using a hardware bypass) lets traffic pass uninspected if the IPS crashes or overloads, which keeps the network up but drops protection. A fail-closed design stops all traffic, which keeps protection but causes an outage. Most organisations choose fail-open at the internet edge, where availability matters most, and fail-closed in front of highly sensitive systems.

Types of IPS

NIST SP 800-94 groups IDPS technologies into four types:

A network-based IPS is what most people mean by “IPS”. Today it is often not a separate box but a feature switched on inside a next-generation firewall (NGFW).

How an IPS detects attacks

SP 800-94 describes three detection methods, and most products combine them:

• Signature-based detection: compares traffic against patterns of known attacks, such as a specific byte string in an exploit or a known malicious URL. Accurate and fast for known threats, blind to new ones until a signature is written.
• Anomaly-based (statistical) detection: learns a baseline of normal behaviour (traffic volume, connection rates, protocols used) and flags large deviations. It can catch new attacks but produces more false positives, and the baseline must be retrained as the network changes.
• Stateful protocol analysis: understands how protocols such as HTTP, DNS or SMB are supposed to work, tracks the state of each session, and flags traffic that breaks the rules, for example an oversized field or commands in the wrong order.

What an IPS does when it detects an attack

• Drop the offending packet so it never reaches the target.
• Reset the connection by sending TCP resets to both ends.
• Block the source address or the whole flow for a set time.
• Rate-limit traffic that looks like a flood.
• Normalise or scrub traffic, for example reassembling fragments so evasion tricks fail.
• Alert and log the event, usually to a SIEM, so analysts can investigate.
• Ask another device to act, such as a firewall rule update.

IDS vs IPS vs firewall

False positives, false negatives and tuning

A false positive is legitimate traffic flagged as an attack. On an IDS it wastes an analyst’s time; on an IPS it blocks a real user or application, which is why many teams run new rules in alert-only mode first. A false negative is an attack that goes undetected, which is worse but harder to see.

Tuning means adjusting the rule set to the network actually being protected:

• disable signatures for systems you do not run (no point inspecting for an IIS exploit on a Linux-only network);
• define internal networks and server groups correctly so rules apply to the right traffic;
• add exceptions for known, harmless traffic that trips a rule;
• move proven, high-confidence rules from alert to block;
• keep signatures updated, as new ones are released as vulnerabilities are published.

Performance and latency

Deep packet inspection is expensive. An IPS must reassemble streams, decode protocols and match thousands of rules at line rate, so every product has a rated inspected throughput that is usually much lower than its raw firewall throughput. Turning on more rules, or decrypting TLS for inspection, lowers it further. If the IPS cannot keep up, it either adds latency and drops packets or, in fail-open mode, lets traffic through uninspected. Size an IPS for peak traffic with the rule set and TLS inspection you actually plan to use.

Examples of IPS tools

• Snort: the original open-source IDS/IPS, created by Martin Roesch in 1998. Cisco bought his company, Sourcefire, in 2013, and Snort is now developed by Cisco, with official rule sets from Cisco Talos. Snort 3, a rewrite with a flow-based engine, became generally available in January 2021. It runs as an inline IPS using DAQ modules such as afpacket or nfq.
• Suricata: an open-source, multi-threaded IDS/IPS developed by the Open Information Security Foundation (OISF). It runs inline in IPS mode on Linux using NFQUEUE or AF_PACKET, and reads rules in a Snort-like format.
• Commercial NGFW-integrated IPS: most next-generation firewall vendors include an IPS engine with a subscription for signature updates, managed from the same console as the firewall. There are also standalone IPS appliances and cloud-delivered IPS within security service edge platforms.

A simple IPS rule, field by field

This rule, valid for both Snort and Suricata running inline, blocks inbound Telnet connections to the internal network:

drop tcp any any -> $HOME_NET 23 (msg:"Inbound Telnet blocked"; flow:to_server; sid:1000001; rev:1;)

Real signatures add content matches (byte patterns inside the payload), protocol buffers and thresholds, but every rule follows this header-plus-options structure. For a broader primer, the SANS white paper on intrusion prevention systems is a useful read, and if you are considering this as a career, see how to become a cyber security engineer.

FAQs

What is a network-based IPS?

A network-based intrusion prevention system (NIPS) is an inline sensor on a network segment that inspects all passing traffic and blocks attacks. It is usually placed behind the firewall at the network edge or between internal zones.

What is the difference between IDS and IPS?

An IDS monitors a copy of traffic and raises alerts but cannot stop an attack. An IPS sits inline, so it can drop packets, reset connections and block sources in real time.

Is an IPS the same as a firewall?

No. A firewall enforces access policy on addresses, ports and protocols. An IPS inspects the content and behaviour of allowed traffic for attacks. Next-generation firewalls often include an IPS engine, which blurs the line.

What are the types of IPS?

NIST SP 800-94 lists four: network-based, host-based, wireless, and network behaviour analysis.

Are Snort and Suricata IDS or IPS?

Both. They run as an IDS on a copy of the traffic, or as an inline IPS that drops traffic using rules with the drop action.

Related Topics on EngineeringHulk

• 👉 Remote Procedure Call (RPC)
• 👉 Application Layer Protocols – Study Guide
• 👉 Computer Networks – Study Guide