An IPS (intrusion prevention system) is a security control that sits inline in the traffic path, inspects packets and sessions for signs of attack, and actively blocks malicious traffic before it reaches its target. In infrastructure defense within cybersecurity, an IPS extends the detection capability of an IDS with the ability to drop packets, reset connections or block sources in real time.
Most IPS deployments today are not separate appliances but a feature of a next-generation firewall or a cloud security service. Host-based variants also exist, running on servers and endpoints. Whatever the form, the defining property is the same: the IPS can stop traffic, which makes its accuracy and its performance far more consequential than those of a passive sensor.
How an IPS inspects and blocks traffic
An IPS receives every packet on the protected link, reassembles flows and normalizes protocols so that evasion tricks such as fragmentation, overlapping segments or unusual encodings cannot hide an attack. It then decodes application protocols like HTTP, DNS, SMB or TLS metadata and compares the content against its detection logic.
When a rule matches, the IPS applies its configured action. Because it is inline, it can silently drop the offending packet, send TCP resets to both endpoints, block the source address for a period, or simply log the event. All of this must happen within microseconds to low milliseconds per packet, since every inspected packet waits for the verdict.
| Method | What it matches | Strength | Weakness |
|---|---|---|---|
| Signature-based | Known exploit patterns and byte sequences | Precise, explainable alerts | Misses new or modified attacks |
| Vulnerability-based | Conditions that trigger a specific flaw | Covers many exploit variants | Requires deep protocol decoding |
| Protocol anomaly | Violations of protocol specifications | Catches malformed and evasive traffic | Legitimate odd software triggers it |
| Statistical anomaly | Deviations from traffic baselines | Can flag unknown attacks | High false-positive rate |
| Reputation-based | Known malicious addresses and domains | Cheap and fast | Lists age quickly |
IPS compared with IDS, firewall and WAF
An IPS overlaps with several neighboring controls in infrastructure defense, and the boundaries matter for design. The key distinctions are placement in the traffic path and the depth of inspection.
| Control | Placement | Primary decision basis | Can block |
|---|---|---|---|
| IPS | Inline | Attack signatures and anomalies in content | Yes |
| IDS | Out of band, on a copy of traffic | Same detection logic as an IPS | No, alerts only |
| Firewall | Inline at network boundaries | Addresses, ports, applications, users | Yes |
| WAF | Inline in front of web applications | HTTP requests and responses | Yes, for web traffic |
| EDR | On the endpoint | Process, file and memory behavior | Yes, on the host |
A firewall decides whether traffic is allowed at all; an IPS decides whether allowed traffic is malicious. A WAF is in effect a specialized IPS for HTTP, with deeper understanding of web parameters, sessions and application logic. The IPS remains broader in protocol coverage, while the WAF goes deeper for web applications.
Deployment modes and performance
An IPS can run in several modes, and the choice determines both its protective value and its risk to availability. New deployments usually begin in a detection-only mode to measure false positives before blocking is enabled.
| Mode | Traffic handling | Typical use |
|---|---|---|
| Inline blocking | Drops or resets matching traffic | Production protection after tuning |
| Inline monitor | Inline but only logs matches | Tuning phase, change windows |
| Passive tap or SPAN | Analyzes a copy, cannot block | Effectively operates as an IDS |
| Fail-open bypass | Passes traffic if the device fails | Availability-critical links |
| Fail-closed | Blocks traffic if the device fails | High-security segments |
Performance is a central sizing parameter. Vendors quote throughput with all signatures enabled and with realistic traffic mixes, and these figures are often much lower than raw firewall throughput. Enabling TLS decryption reduces capacity further, frequently by more than half, so sizing must assume the full feature set that will actually run.
Tuning an IPS for accuracy
An untuned IPS produces either too many false positives, which block legitimate business traffic, or too few relevant blocks because rules were disabled to stop complaints. Effective tuning aligns the rule set with the assets actually present on the protected network.
- Enable rules by asset relevance: protecting Windows file-sharing exploits is pointless on a segment with only Linux web servers.
- Use vendor policy tiers such as balanced or security-focused as a baseline, then adjust.
- Create narrow exceptions for specific hosts and signatures instead of disabling a rule globally.
- Update signatures frequently, typically daily, and review new high-severity rules before blocking.
- Feed IPS events into a SIEM so that blocked attempts correlate with endpoint and identity data.
Tuning is continuous. Applications change, new services appear, and rule updates arrive constantly, so an IPS that was accurate at installation drifts toward noise or blindness without a regular review cycle.
Limitations of intrusion prevention
The largest limitation today is encryption. Without TLS inspection an IPS sees only metadata such as server names, certificates and traffic patterns, not the payload. Decryption restores visibility but raises privacy, performance and certificate management concerns, and some traffic, such as pinned or highly regulated sessions, must be exempted.
An IPS also cannot see attacks inside a host, misses abuse of valid credentials that looks like normal traffic, and offers limited protection against volumetric DDoS, which can overwhelm the IPS itself. It is therefore one layer among several, combined with EDR, identity controls, DDoS mitigation and timely patching.
In everyday language
An IPS is like a security guard standing in a doorway who checks every person walking through. The guard has a list of known troublemakers and a sense of suspicious behavior. When someone matches, the guard stops them on the spot instead of only writing a report.
The advantage is that attacks are stopped before they arrive. The risk is that a guard who is too strict can also block honest visitors, so the guard needs clear instructions and regular updates.
Seen in the real world
A regional hospital runs an older medical records server that cannot be patched for several weeks because the vendor must certify the update. A critical remote code execution vulnerability for that server software becomes public, and exploit code circulates within days.
The network team enables the vendor’s IPS signature for the vulnerability on the next-generation firewall in front of the server segment, first in monitor mode for one day to confirm that no legitimate traffic matches, and then in inline blocking mode.
Over the following weeks the IPS blocks repeated exploitation attempts from scanning hosts on the internet. The server stays uncompromised until the certified patch is installed, a practice known as virtual patching, after which the signature remains active as an additional layer.