An Intrusion Prevention System (IPS) sits inline with traffic and can block attacks in real-time. Unlike IDS, which only alerts, IPS takes action.
When IPS detects malicious traffic, it can:
- Drop the packet
- Block the source IP
- Reset the connection
IPS uses the same detection methods as IDS (signatures and anomaly detection). The difference is placement. IPS must be inline to block traffic. This means IPS failures can disrupt your network if not designed with failover.