Intrusion Prevention Systems (IPS)

An Intrusion Detection System watches traffic and sends you an alert. By the time you read it, the attack already happened. An Intrusion Prevention System sits directly in the traffic path and blocks attacks before they reach their target.

That difference—observing versus acting—changes everything.

The Fundamental Trade-Off

IPS makes a decision about every packet: allow or block. It makes this decision in microseconds, thousands of times per second, with no human in the loop.

Get it wrong one way, and attacks get through. Get it wrong the other way, and legitimate traffic gets blocked. Your customer's purchase fails. Your employee can't access a critical application. Your partner's API calls get dropped.

An IPS blocking your customers' legitimate transactions is worse than not having IPS at all.

This trade-off between security and availability shapes every decision about IPS: where to deploy it, how to configure it, which signatures to enable, what actions to take. There's no escaping it. You're trusting a machine to make split-second judgments, and you'll never know about the ones it gets wrong—until something breaks or something burns.

How IPS Differs from IDS

An IDS sits off to the side, monitoring a copy of network traffic from a span port. It watches. When it sees something bad, it alerts. The attack has already happened; the IDS just noticed.

An IPS sits directly in the traffic path. All packets must flow through it. When it sees something bad, it drops the packets. The attack is prevented in real-time.

This positioning is the difference between a security camera and a locked door. The camera records the break-in. The door stops it.

Deployment Models

Inline mode puts the IPS directly in the traffic path. Every packet flows through it. Maximum protection—but the IPS becomes a single point of failure. If it crashes, traffic stops.

Passive mode operates like IDS, monitoring traffic from a span port. When it detects an attack, it sends reset packets to kill the connection. Less protection—packets reach their target before the reset arrives—but no single-point-of-failure risk.

Hybrid mode uses inline IPS for critical systems and passive IPS elsewhere. Strong protection where it matters most, reduced risk everywhere else.

Production deployments typically use redundant IPS devices in failover configurations—inline protection without the single-point-of-failure problem.

Detection Methods

IPS uses the same detection approaches as IDS, but the stakes are higher. A false positive in IDS generates an unnecessary alert. A false positive in IPS blocks legitimate traffic.

Signature-based detection compares traffic against databases of known attack patterns. High accuracy for known attacks. Low false positive rates. But it only catches threats someone has already seen and written a signature for.

Anomaly-based detection learns what "normal" looks like and flags deviations. Can catch unknown attacks. But "unusual" isn't the same as "malicious," and blocking unusual traffic is risky. That unusual traffic might be your CEO's new workflow.

Behavioral analysis examines how protocols and applications behave. A web request that violates HTTP specifications. An application making calls it shouldn't. Traffic patterns that indicate reconnaissance or exfiltration.

Reputation-based prevention blocks traffic to or from IP addresses, domains, or URLs with bad reputations. If an address is known to be malicious, don't wait to see what it does—block it preemptively.

Prevention Actions

When IPS detects a threat, it has options beyond simple allow or block.

Drop silently discards packets. From the attacker's perspective, packets vanish into nothing. No response, no acknowledgment, no information about what happened.

Reject blocks packets and actively terminates the connection with a TCP reset or ICMP unreachable message.

Alert only generates an alert without blocking—effectively operating as IDS. Useful when tuning, or when you want visibility without the risk of blocking legitimate traffic.

Temporal blocking temporarily blocks an IP address showing attack patterns. All traffic from that source gets dropped for minutes or hours. Contains the attack without permanent blocks that might affect legitimate users who later get assigned that IP.

Quarantine redirects suspicious traffic to an isolated network for analysis instead of blocking outright.

Sophisticated IPS applies different actions to different threats. Drop clear attacks immediately. Alert on ambiguous traffic. Temporarily block repeat offenders.

The Tuning Problem

False positives—legitimate traffic incorrectly identified as attacks—are the primary challenge with IPS.

Effective deployment starts in detection-only mode. The IPS generates alerts without blocking. You watch these alerts, identify which ones flag legitimate traffic, and adjust. Create exceptions. Tune thresholds. Disable signatures that cause problems.

Only after this tuning period do you transition to prevention mode—and even then, gradually. Start with signatures that have near-zero false positive rates. Add more as confidence grows.

This tuning never ends. Applications change. Networks evolve. Traffic patterns shift. What wasn't a false positive yesterday becomes one when someone deploys a new application or changes a workflow.

Performance Reality

Inline IPS must inspect every packet and decide allow or block without introducing noticeable latency. This requires serious processing power.

Deep packet inspection, signature matching, protocol analysis, state tracking—these are computationally expensive operations happening on every packet. High-traffic networks need IPS appliances with specialized processors designed for this work.

Performance numbers in marketing materials are misleading. An IPS might achieve 10 Gbps with basic signature matching. Enable full deep packet inspection, SSL decryption, and advanced threat features, and you might get 2 Gbps. Size IPS for your actual requirements with all needed features enabled, not for theoretical maximums.

The Encryption Problem

Encrypted traffic is invisible to IPS. The packets flow through, but their contents are opaque.

SSL/TLS inspection solves this by having the IPS act as a man-in-the-middle. It terminates the encrypted connection from the client, inspects the traffic, then establishes a new encrypted connection to the server. Full visibility, but significant performance cost and complex certificate management.

Some attacks can be detected even in encrypted traffic through metadata—connection patterns, packet sizes, timing, destination reputation—without seeing the contents. But the most effective IPS inspection requires decryption.

Network vs. Host-Based IPS

Network-based IPS (NIPS) sits in network traffic paths, protecting multiple systems from a single deployment point. Broad coverage, but can't see inside encrypted connections without SSL inspection, and must be positioned to see all relevant traffic.

Host-based IPS (HIPS) runs on individual systems. Sees traffic after decryption. Can prevent attacks that don't generate network traffic at all. But requires installation on every protected system and consumes host resources.

Most organizations use both. NIPS for network-level threats across the infrastructure. HIPS for critical systems that need additional protection.

What IPS Can't Do

IPS is one layer of defense, not a complete solution.

Encryption hides attack traffic unless you deploy SSL inspection.

Polymorphism lets attackers modify their techniques to evade signatures while achieving the same result.

Zero-day exploits have no signatures because no one has seen them before.

Slow attacks spread malicious activity over hours or days, staying under detection thresholds.

Application-layer attacks within allowed traffic can slip through—SQL injection in a legitimate HTTP request, for example.

Social engineering and phishing don't involve the network attack patterns IPS looks for.

Insider threats come from authorized users doing authorized things with malicious intent.

IPS stops a meaningful class of attacks. It doesn't stop all attacks. Nothing does.