Intrusion Prevention Versus Intrusion Detection

Intrusion detection is powerful in that you can be notified when potential problems or attacks are introduced into your network. However, detection provides only limited capabilities for preventing attacks from being successful. Detection is limited because it operates on copies of packets. These copies of packets are usually received from another Cisco device (typically a switch). Sensors that operate using intrusion detection are said to run in promiscuous mode.

Intrusion prevention is more powerful because the sensor has much greater capabilities for preventing malicious traffic from entering your network or a particular network segment. The sensor can perform prevention because it operates inline with packet flows.