IDS vs IPS vs Firewall
Parameter
Abbreviation For
Philosophy
Principle Of Working
Configuration Mode
Placement
Traffic Patterns
Placement w.r.t Each Other
Action On Unauthorized Traffic
Detection
Related Terminologies
FIREWALL IPS IDS
- Intrusion Prevention System Intrusion Detection System
Firewall is a network security device that filters An intrusion detection system (IDS) is a device or software
IPS is a device that inspects traffic, detects it, classifies
incoming and outgoing network traffic based on application that monitors a traffic for malicious activity or
and then proactively stops malicious traffic from attack.
predetermined rules policy violations and sends alert on detection.
Inspects real time traffic
Detects real time traffic and
Filters traffic based on IP and looks for traffic
looks for traffic patterns or
address and port patterns or signatures of
signatures of attack and
numbers attack and then prevents
them generates alerts.
the attacks on detection.
Inline or as end host (via span) for monitoring and
Layer 3 mode or transparent mode Inline mode , generally being in layer 2
detection
Inline at the Perimeter of Network Inline generally after Firewall Non-Inline through port span (or via tap)
Not analyzed Analyzed Analyzed
Should be placed after the Should be placed after
Should be 1st Line of
Firewall device in network firewall
defense
Block the traffic Preventing the traffic on Detection of anomaly Alerts/alarms on detection of anomaly
• Anomaly based detection
• Anomaly based detection
• Signature detection
• Stateful packet filtering • Signature detection
• Zero day attacks
• permits and blocks traffic by port/protocol • Zero day attacks
• Monitoring
rules • Blocking the attack
• Alarm