What is an IDS?

An Intrusion Detection System (IDS) is a network security control that examines a copy of network traffic – typically fed from a switch’s mirror port, a hub, or a network tap – for indications of vulnerabilities and inappropriate or anomalous activity, and raises an alert on a match without touching the traffic itself.

Key takeaways

• IDS detects and alerts on threats; it does not block them like IPS does.
• Deployed passively via a mirror port, network tap, or hub – never inline.
• Signature-based and anomaly-based detection together catch known and new attacks.
• A failed IDS sensor never takes the production traffic path down with it.
• Versa’s IDP module pairs IDS visibility with IPS enforcement in one pass.

On this page: Why it matters · How it works · Types · IDS & Versa · FAQ

Why is an IDS important?

A firewall decides which sessions to allow by port, address, and application – it says nothing about what’s inside a permitted session. An attacker tunneling an exploit inside legitimate-looking traffic passes through unless something inspects the payload. An IDS closes that gap: it watches a copy of traffic and flags activity matching a known attack pattern or deviating from baseline.

Because an IDS inspects a mirrored copy rather than sitting inline, it never becomes a point of failure – if the sensor goes down, traffic keeps moving. That posture also makes internal placement practical: sensors inside the firewall and at critical nodes reveal activity that already crossed the perimeter, exactly where lateral movement first surfaces. An IDS only alerts, though; stopping traffic still needs a paired inline control such as an IPS.

What is an IDS?

An IDS is the detection half of intrusion detection and prevention (IDP): it inspects traffic and alerts on a match rather than acting on it. It’s commonly connected to a switch’s mirror port, a hub, or a network tap; less commonly it’s placed inline, trading away its fail-safe advantage.

Two techniques do the matching. Signature-based detection compares traffic against a database of known attack patterns. Anomaly detection instead baselines normal traffic and flags deviations from it, catching new attacks no signature yet describes. Alerts use a standard vocabulary: a true positive is a real attack correctly flagged, a false positive is benign traffic wrongly flagged, and a false negative slips through undetected – each scored against its CVE (vulnerability ID) and CVSS (severity) rating.

Types of IDS

Deployment scope is the main axis. A network-based IDS (NIDS) monitors a whole segment from one vantage point – a mirrored port, hub, or tap – watching every session crossing it. A host-based IDS (HIDS) instead runs as an agent on a single endpoint, watching its system calls, logs, and file-integrity changes – depth a segment-wide NIDS can’t provide. Organizations commonly run both together.

Placement is a second axis. An IDS at the perimeter sees traffic entering and leaving the organization; sensors inside the firewall and at critical nodes add visibility into activity already past it – reconnaissance and compromised-host traffic a perimeter-only view would miss. Mature deployments combine both placements.

IDS & Versa

Versa delivers IDS as part of VOS’s intrusion detection and prevention (IDP) module, part of the unified threat management (UTM) capabilities in Secure SD-WAN. Rather than separate IDS and IPS appliances, Versa implements both through one vulnerability-profile mechanism inside an NGFW policy rule: the configured action sets the behavior – Alert alone behaves as an IDS; Drop, Reject, or Reset behave as IPS enforcement.

Administrators typically start from a predefined profile – the Versa Recommended Profile (16 GB RAM) for broad coverage, or the lighter Versa Branch Profile (8 GB RAM) for constrained branches – updated via security packages (SPacks), then layer custom Snort-format signatures on top. Director tracks signature compilation; Analytics surfaces threats and IDP logs. See Configure Intrusion Detection and Prevention (NGFW) or the classic guide for the workflow.

Frequently asked questions

What is the difference between an IDS and an IPS?

An IDS monitors a copy of traffic – from a mirror port, hub, or tap – and alerts on suspicious activity without touching the flow. An IPS sits inline and blocks it automatically: dropping packets, resetting connections, or blocking the source.

Where is an IDS deployed in a network?

Most commonly off a switch’s mirror port, attached to a hub, or fed by a network tap, receiving a copy of traffic without sitting in the forwarding path. Deployments often add sensors inside the firewall and at critical nodes too.

Does an IDS block malicious traffic?

No. An IDS is detection-only – it inspects traffic and alerts when it matches a signature or deviates from a normal-traffic baseline, but never drops a packet or resets a connection. Blocking requires an analyst’s response or a paired inline control such as an IPS.

Can an IDS cause a network outage if the sensor fails?

No, by design. Because an IDS analyzes a mirrored copy of traffic rather than sitting inline, the production path is unaffected if the sensor goes down. A switch-based deployment typically maintains a keepalive session between switch and device to guard against this failure.

What do CVE and CVSS mean in an IDS alert?

CVE (Common Vulnerabilities and Exposures) is a dictionary of publicly known security vulnerabilities that an IDS signature maps to. CVSS (Common Vulnerability Scoring System) scores that vulnerability’s severity. Analysts use both together to prioritize which alerts need investigation first, and which can wait.

More on IDS

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about IDS, these are worth looking at next.