Defence: intrusion detection and prevention
A scanner probes a web server port after port. The first few probes get answers, then nothing comes back. Follow the scan into an inline IPS that drops it once it crosses a rule, and a passive IDS that watches copies from a mirror port and raises the alarm. See how they spot attacks, where they go wrong, what encryption hides from them, and how every alert ends up in a SIEM.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01What can an IPS do that an IDS on a mirror port cannot?
The IPS sits inline, so every packet passes through it and it can drop or block. The IDS only receives copies, so the original packets have already gone on; it can only raise an alert.
02One source touches 100 different ports in 3 seconds. A normal visitor touches one or two. Which kind of detection flags this best?
Each probe is a plain SYN that matches no signature. The behaviour as a whole is far from normal, and that is what anomaly detection looks for.
03An IPS blocks a backup job that legitimately connects to many ports. What is this called?
Harmless traffic was flagged as an attack. A false negative is the opposite mistake: a real attack that is not flagged.
04Why can a sensor not match content signatures inside HTTPS traffic?
TLS encrypts the contents. The sensor can still spot a scan from addresses and ports, but not an exploit hidden inside the encrypted request.
05Why does a probe dropped by the IPS tell the scanner so little?
Without the IPS, an open port answers SYN-ACK and a closed port answers RST, which tells the scanner a lot. A dropped probe gets silence.
Glossary
- IDS
- Intrusion detection system: a sensor that inspects traffic, usually copies of it, and raises alerts. It cannot stop traffic.
- IPS
- Intrusion prevention system: a sensor placed inline, in the traffic's path, that can drop packets and block sources.
- Inline
- In the path: every packet must pass through the device to reach its destination.
- Port mirroring (SPAN)
- A switch feature that copies the frames of one or more ports to a spare port, where a sensor can read them.
- Signature
- A known attack pattern, such as specific bytes or flags, that a rule matches exactly.
- Anomaly detection
- Flagging behaviour that is far from a normal baseline, such as one source touching many ports in seconds.
- False positive / false negative
- A false positive flags harmless traffic; a false negative misses a real attack.
- SIEM
- Security information and event management: a system that collects logs and alerts from many sources and links them on one timeline.
Notes and sources
- The scan rate (100 ports in 3 s), the rule (20 ports in 60 s) and the 10-minute block are illustrative; real products let the operator set them. A threshold rule only trips once it is crossed, so the first 20 probes still reach the server.
- 198.51.100.66, 192.0.2.7 and 203.0.113.10 are RFC 5737 documentation addresses.
- Sensors are often placed both outside and inside a protecting device: outside sees every attempt, inside sees only what got through (NIST SP 800-94).
- Because an IPS is in the path, its owner must choose what happens if it breaks: fail open (traffic flows unchecked) or fail closed (traffic stops).
- Instead of a mirror port, a network tap can copy traffic off the cable itself; a busy mirror port can drop copies when it is overloaded.
Quiz Unlocks after the last step.