NetSec Intrusion Prevention Systems
An Intrusion Prevention System (IPS) does everything an IDS does — monitors and detects — and adds one critical capability: it blocks threats in real time without human intervention. The IPS sits directly in the path of traffic (inline), so it can drop malicious packets before they reach their destination. This makes the IPS an active defense rather than a passive monitoring tool.
IPS vs IDS — The Core Difference
IDS (Passive — out of band):
Traffic path: [Internet] → [Firewall] → [Switch] → [Server]
IDS position: ↑
mirror port copy
IDS watches but cannot act
It just sends alerts
IPS (Active — inline):
Traffic path: [Internet] → [Firewall] → [IPS] → [Switch] → [Server]
↑
IPS inspects EVERY packet
Malicious packet → DROPPED
Clean packet → forwarded
How the IPS Makes Blocking Decisions
The IPS applies detection logic in microseconds as packets arrive. It must process traffic fast enough not to become a bottleneck. Modern IPS hardware processes multi-gigabit traffic with microsecond decision times.
IPS Decision Flow for Each Packet:
Packet arrives
│
▼
Check signature database
│
┌──┴──┐
│Match│ → DROP packet + LOG + ALERT
└──┬──┘
│ No match
▼
Check anomaly baseline
│
┌──┴──────────┐
│ Anomalous? │ → DROP + RATE LIMIT source + ALERT
└──┬──────────┘
│ Normal
▼
Check threat intelligence
│
┌──┴─────────────┐
│ Known bad IP? │ → DROP
└──┬─────────────┘
│ Not flagged
▼
FORWARD packet to destination
IPS Response Actions
Action | What Happens ---------------------|--------------------------------------------------- Drop packet | Silently discards the malicious packet Reset connection | Sends TCP RST to both parties, terminates the session Block source IP | Adds IP to block list for a defined period Rate limit | Allows some traffic but throttles high-volume sources Alert | Notifies security team (usually happens alongside other actions) Quarantine | Isolates the source host from the network (endpoint IPS) Redirect | Sends suspicious traffic to a honeypot for analysis
Types of IPS
Network-Based IPS (NIPS)
Sits inline at network boundaries — typically behind the perimeter firewall and in front of internal segments. It protects the entire network segment it guards. A single NIPS appliance can protect hundreds of servers.
Typical NIPS Placement:
[Internet]
│
[Perimeter Firewall] ← blocks based on IP/port rules
│
[NIPS] ← inspects all allowed traffic for attacks
│
[Internal Network] ← only clean traffic reaches here
Host-Based IPS (HIPS)
Software running on individual devices that monitors and blocks malicious activity at the operating system level. HIPS stops attacks that have already passed the network perimeter — privilege escalation attempts, malicious process execution, unauthorized registry changes on Windows.
Wireless IPS (WIPS)
Monitors wireless traffic and automatically responds to threats: disconnecting rogue access points, blocking devices that attempt de-authentication attacks, or alerting when someone attempts to connect to an evil twin AP.
The False Positive Problem in IPS
A false positive in an IDS causes an unnecessary alert — annoying but harmless. A false positive in an IPS drops legitimate traffic — disrupting real users. This is why IPS tuning and testing require more care than IDS tuning.
False Positive in IDS: Security analyst gets an alert for normal traffic
→ Analyst reviews, marks as false positive
→ Business unaffected
False Positive in IPS: IPS drops a legitimate database query
→ Application errors out
→ Users call IT support
→ Business disrupted
IPS requires careful signature tuning and thorough testing before deployment.
New signatures should be deployed in "detection mode" first,
confirmed accurate, then switched to "prevention mode."
IPS Evasion Techniques
Sophisticated attackers know that IPS systems exist and actively attempt to evade them:
Evasion Technique | How It Works ----------------------------|--------------------------------------------------- Packet fragmentation | Splits attack across multiple packets; IPS may not reassemble Protocol confusion | Sends traffic that differs at TCP/IP vs application layer Polymorphic attack code | Changes malware code structure on every attempt Slow attacks | Sends packets slowly, below anomaly thresholds Encrypted payloads | Hides attack in TLS until IPS without SSL inspection TTL manipulation | Different TTL values confuse some IPS implementations
Modern IPS Integration
Standalone IPS appliances are increasingly integrated into Next-Generation Firewalls (NGFW). The combined NGFW+IPS performs firewall filtering, application identification, user tracking, and intrusion prevention in a single device with a single management interface. This consolidation reduces complexity and eliminates gaps between separate devices.
NGFW with Integrated IPS: Single device performs: ✓ Stateful packet inspection (firewall) ✓ Application identification (block specific apps) ✓ User identity awareness (policy per user) ✓ Intrusion prevention (block attack traffic) ✓ SSL/TLS inspection (see inside HTTPS) ✓ URL filtering (block malicious websites) ✓ Threat intelligence (block known bad IPs/domains)
An IPS deployed correctly represents one of the highest-value security controls available. It stops attacks automatically, at machine speed, before they reach vulnerable systems — without requiring a human to first see an alert, investigate, and then respond. The investment in proper tuning and ongoing signature maintenance pays dividends in attacks stopped silently, before they become incidents.