The attack fails
A scanner at 198.51.100.66 sends SYN probes, the first message of a TCP connection, to port after port of the web server. Most never arrive: after the first 20, a box in the path drops the rest, and the scanner gets only silence back.
Where they sit
That box is an IPS, an intrusion prevention system. It sits inline, right in the path, so every packet must pass through it. A visitor's normal web request is checked and passed straight on to the server.
An IDS, an intrusion detection system, works from copies. The edge switch copies every frame to a spare mirror port, also called SPAN. The IDS reads the copies, so it never slows traffic, but it cannot stop any either.
How they spot it
Signatures are known attack patterns, like fingerprints on file: exact bytes or flags seen in past attacks. They are precise but blind to brand-new tricks. One scan probe is a plain SYN, just like a visitor's, so no signature matches it.
Anomaly detection compares behaviour with normal. A visitor touches one or two ports; this source touched 100 ports in 3 seconds, far over a rule of 20 ports a minute. The pattern, not any one packet, gives the scan away.
An IDS can only report. It writes an alert with the time, source, target and rule, and sends it to the SIEM. On its own it stops nothing: without the IPS, all 100 probes would reach the server.
The IPS runs the same checks but can act. Once the rule trips, at the 21st port, it drops every later probe and blocks 198.51.100.66 for a while. A closed port would answer with a reset (RST); now the scanner hears nothing.
Limits and logs
Detection makes two kinds of mistake. A false positive flags harmless traffic, like a backup job sweeping many ports, and an IPS would wrongly block it. A false negative misses a real attack. Tuning rules trades one against the other.
Inside HTTPS the contents are scrambled, so content signatures cannot match them. The IPS still sees addresses, ports, sizes and timing: enough to spot a scan, not enough to spot an exploit hidden inside.
The IDS, the IPS and the server all send their logs to the SIEM, a security information and event management system. It lines events up on one timeline and links them, so a person sees the whole story.
On the wire and in the log
;; step 1/10 · scan-dropped · probe ;; Scanner → Web server TCP 198.51.100.66:51000 → 203.0.113.10:21 SYN TCP 198.51.100.66:51000 → 203.0.113.10:22 SYN TCP 198.51.100.66:51000 → 203.0.113.10:23 SYN TCP 198.51.100.66:51000 → 203.0.113.10:25 SYN … (100 ports in 3 s) probes 1–20 reach the server → SYN-ACK or RST back probes 21–100 IPS verdict DROP, no reply sent scanner sees silence on 80 ports → "filtered"
Sensors are often placed both outside and inside a protecting device: outside sees every attempt, inside sees only what got through (NIST SP 800-94). Because an IPS is in the path, its owner must choose what happens if it breaks: fail open (traffic flows unchecked) or fail closed (traffic stops).