Short answer
An intrusion prevention system (IPS) sits inline in the traffic path, inspects sessions against signatures, protocol rules and behavioral baselines, and blocks traffic it identifies as an attack. NIST defines it as a system that can detect an intrusive activity and also attempt to stop the activity, ideally before it reaches its targets. An IDS sees a copy of the same traffic and can only alert.
Key facts
- NIST defines an IPS as a system that can detect an intrusive activity and also attempt to stop the activity, ideally before it reaches its targets.
- The difference from an IDS is placement: an IDS reads a copy of traffic out of band and alerts; an IPS is in the path and can drop the session.
- NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems, was published in February 2007 and groups the products into four classes.
- Those four classes are network-based, wireless, network behavior analysis software, and host-based.
- On current appliances intrusion prevention is built into the next-generation firewall rather than running as a separate appliance in the path.
- An inline IPS is a failure point: choose fail-open or fail-closed per segment, and size on threat-prevention throughput, not the raw firewall figure.
By Uniqcli Team
An intrusion prevention system (IPS) is a security control placed inline in the traffic path. Every packet on the protected segment passes through it, the engine compares that traffic against signatures, protocol rules and behavioral baselines, and sessions it identifies as attacks are dropped or reset before they reach the target. NIST describes the category plainly: a system that can detect an intrusive activity and also attempt to stop the activity, ideally before it reaches its targets.
That single word — inline — is the whole difference from an intrusion detection system. An IDS receives a copy of traffic from a mirror port or a tap, so it can raise an alert but cannot remove a packet from a conversation it never touched. An IPS is in the conversation, which is why it can block and also why it is a failure point that has to be sized, tuned and monitored like any other device carrying production traffic.
In current hardware the IPS is rarely a separate box. On enterprise appliances it is an inspection engine inside a next-generation firewall, licensed and enabled alongside application identification and TLS decryption, which is why the throughput number that matters is the one measured with threat prevention turned on.
How does an IPS work?
An IPS terminates nothing and forwards everything it does not object to, so its normal state is a fast path. Traffic is reassembled into flows, normalized so that fragmentation and encoding cannot hide a payload, and then evaluated. Signature matching looks for known patterns from a vendor-maintained feed. Protocol analysis checks that a session behaves the way the protocol's own specification says it should. Behavioural analysis compares volume, timing and destinations against a learned baseline. Most appliances run more than one of these at once and score the result.
When a rule fires, the action is set per rule rather than globally: alert only, drop the packet, reset the session, or block the source address for a period. The tuning work is deciding which rules act and which only report. A rule set left entirely on drop out of the box will interrupt legitimate traffic; a rule set left entirely on alert is an IDS wearing an IPS badge.
Because it is inline, an IPS also has a failure behavior that has to be chosen deliberately. Fail-open hardware bypasses the inspection engine and keeps the link up if the engine or the appliance dies; fail-closed drops the link. Neither is universally right — a segment carrying life-safety or building systems is usually fail-open, a segment carrying regulated data is usually fail-closed — but leaving it undecided means the answer is whatever the vendor shipped.
IPS vs IDS vs firewall: what does each one actually do?
A firewall decides whether a conversation is allowed at all. Classic stateful inspection answers that on addresses, ports and connection state; a next-generation firewall answers it on the application, the user and the content. Either way, the firewall's question is permission.
An IDS and an IPS ask a different question: given that this conversation is permitted, does its content look like an attack? An IDS answers out of band and produces an alert for a person or a logging platform. An IPS answers inline and produces an action. The two are not alternatives so much as the same detection logic deployed at two different points, which is why organizations frequently run both — an IPS on the perimeter and internal chokepoints, an IDS on spans where dropping traffic is unacceptable.
NIST SP 800-94 covers the family as one topic, intrusion detection and prevention, and groups the products into four classes: network-based, wireless, network behavior analysis software, and host-based. A network IPS in the rack and a host-based agent on a server are answering the same question from different vantage points, and a design that buys only one of them has a blind spot rather than a saving.
What should you check before buying one?
Start with throughput measured the way you will run it. A datasheet's raw firewall figure is measured with inspection off; the threat-prevention figure describes an appliance with the IPS engine doing work. Read both from the same datasheet and size against the second, then add headroom for TLS decryption if you intend to inspect encrypted sessions, because decryption is usually the heaviest single feature on the box.
Then look at the operational surface. Where does the signature feed come from and how often does it update? Can rules be tuned per segment rather than globally? Does the appliance carry the interface types and the port count you need for the segments you actually want to protect, including internal chokepoints rather than only the internet edge? And confirm the failure behavior of the inline interfaces, because that is a wiring decision as much as a configuration one.
Finally, plan for the alerts. An IPS in a rack that nobody watches is a filter, not a control. Confirm the appliance can forward events in a format your logging platform already reads, and decide up front who reviews what fires and on what cadence.
Key takeaways
- An IPS sits inline in the traffic path and can drop or reset a session; an IDS sees a copy of traffic and can only alert.
- NIST defines an IPS as a system that can detect an intrusive activity and also attempt to stop it before it reaches its targets.
- Detection combines signature matching, protocol analysis and behavioral baselines; the tuning work is deciding which rules act and which only report.
- On current hardware the IPS is usually an engine inside a next-generation firewall, not a separate appliance in the rack.
- Size on the datasheet's threat-prevention throughput, not the raw firewall figure, and add headroom for TLS decryption.
- Because it is inline, an IPS is a failure point — choose fail-open or fail-closed per segment rather than accepting the default.
Shop it at Uniqcli
Parts for this job
Small site
Sophos
Sophos XGS 88 Network Security/Firewall Appliance
ZD88ZZ51ZZNGAA
A four-port desktop or rack-mountable appliance whose listing records 9.67 Gbit/s of firewall throughput on 2.5GBase-T ports — the platform size for a small site.
Size on the throughput figure measured with threat prevention enabled, not the raw firewall number.
$250.42Back-orderedBranch office
SonicWall
SonicWall TZ280 Network Security/Firewall Appliance
03-SSC-6937
An eight-port SonicWall appliance whose own listing names intrusion prevention, at 2.50 Gbit/s of firewall throughput for a branch or a small campus edge.
$482.08Back-orderedLarger edge
Check Point Software Technologies
Check Point Quantum Spark 2550 Network Security/Firewall Appliance
CPAP-SG2550-SNBT
A six-port Check Point appliance listed at 3.91 Gbit/s of firewall throughput with intrusion prevention and two expansion slots, for an edge that needs interface flexibility.
$1,231.13Back-orderedFrequently asked
- What are the differences between IDS and IPS?
- Placement and authority. An IDS is deployed out of band — it reads a copy of traffic from a mirror port or tap, so it can raise an alert but cannot remove a packet from the conversation. An IPS is deployed inline, so every packet passes through it and a rule can drop the packet, reset the session or block the source. The detection logic is largely the same; what differs is whether the device is in a position to act, and whether it becomes a failure point in the path.
- Can IDS and IPS work together?
- Yes, and many networks run both. A common pattern is an inline IPS at the internet edge and at internal chokepoints where blocking is acceptable, plus an IDS on span ports covering segments where dropping traffic is not an option — process control, building systems, or a lab. Both feed the same logging platform, so the IDS gives visibility where the IPS cannot act, and the correlated events are more useful than either alone.
- Is an IPS the same as a firewall?
- No. A firewall decides whether a conversation is permitted, using addresses and ports on a stateful firewall or application and user identity on a next-generation firewall. An IPS decides whether the content of a permitted conversation looks like an attack. On most current appliances both run in the same chassis, but they are separate engines answering separate questions, and the IPS is generally a licensed feature rather than part of the base firewall.
- Does an IPS slow the network down?
- It adds processing to every packet, so yes, measurably. How much depends on sizing: datasheets publish a raw firewall throughput figure and a lower threat-prevention figure measured with inspection running, and TLS decryption reduces it further. Size against the threat-prevention number with headroom and the added latency is not something users notice; size against the raw number and the appliance becomes the bottleneck.
Sources
- 1.NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)csrc.nist.gov
- 2.NIST Computer Security Resource Center glossary — intrusion prevention systemcsrc.nist.gov
- 3.NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policycsrc.nist.gov
- 4.Palo Alto Networks — what is a next-generation firewall (NGFW)paloaltonetworks.com
Keep reading