What is IPS (Intrusion Prevention System)?
Updated: 2 days ago
An intrusion prevention system (IPS) is a security control that monitors network or system activity for signs of malicious behaviour and can automatically take action to stop a detected threat. The key distinction is prevention: an IDS primarily detects and alerts, while an IPS can sit in the traffic path and block, reject or disrupt suspicious activity before it reaches its target.
That does not mean an IPS can guarantee that an attack will be stopped. Its effectiveness depends on what it can see, how detection is configured, where it is deployed and whether legitimate traffic can be distinguished from malicious traffic.
How does an IPS work?
A network IPS is commonly deployed inline, meaning packets pass through the device or software function on their way to a destination. It can examine packet headers, connection state and, where visible, application content. This overlaps with packet inspection, but adds an active prevention decision.
Traffic reaches the IPS before the protected destination.
The IPS inspects available packet, flow, session or application information.
Detection logic compares the traffic with signatures, rules, protocol expectations or behavioural indicators.
If traffic is considered acceptable, the IPS allows it to continue.
If traffic matches a prevention rule, the IPS can drop packets, reject or reset a connection, rate-limit activity, quarantine a source through another control, or trigger another configured response.
The event is normally logged and may also generate an alert for investigation.
The exact response depends on the product and deployment. Some IPS functions are integrated into next-generation firewalls, routers, cloud security services or endpoint security platforms rather than being a separate appliance.
The infographic below shows the central difference between detection and prevention, plus the basic inline traffic decision an IPS makes.
IPS vs IDS: what is the difference?
An IDS is primarily an observation and alerting control. An IPS adds the ability to attempt prevention. NIST describes an IPS as having the capabilities of an IDS while also being able to attempt to stop possible incidents. In practical terms, this difference changes where the system can be placed and the risk of an incorrect decision.
IDS: detects suspicious activity, records it and alerts an administrator or security platform.
IPS: detects suspicious activity and can automatically interfere with or block it.
Operational trade-off: an IDS false positive creates an alert. An inline IPS false positive can interrupt legitimate traffic.
What can an IPS inspect?
Visibility varies substantially between products. An IPS may use source and destination IP addresses, ports, protocols, TCP state, packet structure, application protocol behaviour, known exploit signatures, reputation data and behavioural patterns.
Encryption changes that picture. With TLS and HTTPS, an intermediary IPS can still see some connection metadata, but it cannot automatically inspect protected application payloads. Deep inspection of encrypted content requires a legitimate architecture that terminates or decrypts that traffic, which introduces privacy, trust, certificate and performance considerations.
How does an IPS detect threats?
Signature-based detection: looks for patterns associated with known exploits, malware or attack techniques.
Protocol or policy analysis: identifies traffic that violates expected protocol behaviour or configured security rules.
Anomaly or behaviour-based detection: looks for activity that differs from an established or expected pattern.
Reputation and threat intelligence: may use known malicious addresses, domains or indicators as additional context.
No detection method is perfect. Signature detection can miss new or modified attacks. Behavioural detection can identify unusual activity but may produce more false positives. Effective deployments normally combine multiple signals and tune them to the environment.
Where is an IPS deployed?
A network IPS needs visibility of the traffic it is expected to protect. Common positions include an internet edge, between security zones, around critical servers, or between segmented networks. Network segmentation and VLANs can create useful enforcement boundaries, but an IPS only sees traffic that actually traverses its inspection point.
A firewall and an IPS are related but not identical. A firewall enforces traffic policy, often using addresses, ports, connection state and increasingly application-aware controls. An IPS focuses on detecting malicious or exploit-like activity and taking prevention action. Modern security platforms often combine both functions.
Network IPS vs host-based prevention
Network-based prevention analyses traffic moving through a network inspection point. Host-based prevention runs on or close to an individual endpoint or server and can use local context such as processes, files, system calls and application behaviour. The two approaches protect different parts of the attack path and can complement each other.
What happens when an IPS blocks traffic?
Prevention is not limited to one action. Depending on the system and protocol, an IPS can drop the offending packet, discard subsequent packets in the flow, send a reset or rejection, block a source for a period, rate-limit traffic, or ask another security control to enforce a new rule. The chosen action should match the confidence of the detection and the potential impact of blocking legitimate traffic.
False positives and false negatives
A false positive occurs when legitimate activity is classified as malicious. A false negative occurs when malicious activity is not detected. For an IPS, false positives are particularly important because the system may be allowed to interrupt real traffic automatically.
High-confidence rules can often be configured for automatic blocking.
Lower-confidence detections may be better used for alerting, logging or additional investigation.
Rules should be tested against normal traffic before aggressive prevention is enabled.
Signatures, software and threat intelligence need ongoing maintenance.
Exceptions should be narrow and documented rather than used to silence repeated alerts.
How encryption affects IPS visibility
Modern internet traffic is heavily encrypted. An IPS positioned between a client and an encrypted service generally cannot read the protected application payload simply because it can see the packets. It may still use IP addresses, ports, timing, flow characteristics and other exposed metadata.
Some enterprise architectures deliberately decrypt traffic at a controlled inspection point and then re-encrypt it. That can restore application-layer visibility, but it also changes the trust model and must be designed around privacy, certificate management, security, performance and legal requirements. It should not be described as a universal IPS capability.
Does an IPS slow down broadband or network traffic?
It can. An inline IPS adds processing to the traffic path. The practical impact depends on the throughput of the IPS, enabled inspection features, packet sizes, number of concurrent sessions, encryption handling and hardware acceleration. A device advertised for a high firewall throughput may achieve a lower rate when full threat prevention is enabled.
For a home or small-business multi-gigabit connection, the important question is not simply whether the router has 2.5GbE or 10GbE ports. The IPS engine itself must sustain the required inspected throughput. If it cannot, security processing can become the bottleneck even when the broadband line and Ethernet interfaces are faster.
Techie Broadband practical capacity example
Consider a 2.5 Gbps symmetrical broadband service connected through a security appliance whose IPS throughput is 1 Gbps with the required inspection features enabled. The 2.5 Gbps interfaces do not remove the processing limit. In that configuration, inspected traffic can be constrained by the approximately 1 Gbps IPS capability.
Theoretical comparison: 1 Gbps is 40% of 2.5 Gbps. That does not predict an exact speed-test result, because real throughput depends on protocol overhead, traffic mix, session count and implementation. It simply shows why IPS performance figures must be evaluated separately from port speed.
How to evaluate an IPS on your network
Identify which traffic actually needs inspection and where it crosses the network.
Check the vendor's IPS or threat-prevention throughput figure, not only raw firewall throughput.
Confirm the figure applies with the inspection features you intend to enable.
Test normal business applications before moving rules from alert-only to blocking.
Monitor CPU, memory, session count, latency, packet loss and throughput under realistic load.
Review blocked events and tune false positives rather than disabling broad categories blindly.
Keep signatures, software and threat intelligence current.
Retest after major rule, firmware, network or broadband-speed changes.
IPS misconceptions
An IPS is not a guarantee that malware or attacks cannot get through.
An IPS is not automatically able to read encrypted application content.
An IPS is not the same thing as a firewall, although products often combine both.
More aggressive blocking is not always better because false positives can disrupt legitimate traffic.
A 10GbE interface does not prove that an appliance can inspect 10 Gbps of traffic with prevention enabled.
An IPS does not replace endpoint security, patching, identity controls, backups or secure configuration.
Is an IPS useful on a home broadband connection?
For many homes, a dedicated enterprise-style IPS is unnecessary. Modern routers and security gateways may already include threat-prevention features. More technically advanced home networks, homelabs, self-hosted services and small businesses may gain value from IPS capabilities, particularly where services are exposed to the internet or networks are deliberately segmented.
The main trade-off is complexity. Prevention rules need maintenance and an undersized security appliance can limit a fast FTTP connection. On multi-gigabit broadband, inspect the security-throughput specification carefully before assuming the router can preserve full line rate.
Authoritative definition and standards context
NIST defines an intrusion prevention system as a system that can detect intrusive activity and attempt to stop it, ideally before it reaches its targets. Its Guide to Intrusion Detection and Prevention Systems also distinguishes IPS from IDS by the ability to attempt prevention. NIST IPS glossary and NIST SP 800-94 provide the primary technical references.
Frequently asked questions
Is IPS the same as a firewall?
No. A firewall enforces network access policy, while an IPS focuses on detecting malicious activity and attempting to stop it. Many modern security products combine both functions.
Is IPS better than IDS?
Not automatically. IPS adds active prevention, but that also means a false positive can block legitimate traffic. IDS can be preferable where observation is required without inline enforcement.
Can an IPS inspect HTTPS traffic?
It can inspect exposed connection information, but it cannot simply read the encrypted HTTPS payload. Application-content inspection requires the traffic to be legitimately decrypted or terminated at an inspection point.
Can an IPS block a zero-day attack?
Possibly, but not reliably. Behavioural, anomaly and protocol-based detections may identify previously unknown attacks, while signature-only detection may miss them. No IPS should be treated as guaranteed protection against zero-day exploits.
Can IPS reduce internet speed?
Yes. An inline IPS must process traffic, so an appliance with lower IPS throughput than the broadband connection can become the bottleneck. The impact depends on enabled features, hardware and traffic characteristics.
Key takeaway
An intrusion prevention system is an active security control: it does more than identify suspicious traffic because it can attempt to stop it. The value comes from placing it where it can see the right traffic, tuning detection carefully and ensuring the inspection engine has enough capacity for the network it protects. The most important practical distinction is simple: IDS tells you something suspicious happened; IPS can be configured to do something about it.
To explore the related technical concepts used in this IPS (Intrusion Prevention System) guide, visit our broadband terminology guide.
