Intrusion Detection and Prevention

• Detection is where defensive engineering meets evidence: every incident response starts with 'which sensor saw it'.
• Choosing parameters: signature coverage, TLS visibility, and false-positive budget are daily engineering decisions.
• Placing an IDS/IPS correctly teaches you network design, packet logic, and logging hygiene at once.

It flags the predictable patterns; it cannot read the sealed (encrypted) ones without a key.

• NIDS sensors tap or mirror traffic to inspect copies of packets without adding latency to the data path.
• Signature engines match bytes and state against rule databases (ET, VRT) covering exploits, malware beacons, and policy violations.
• Anomaly/behavior engines baseline flows and flag outliers: sudden east-west spam, a host phoning a new external IP.
• IPS mode sits in the forwarding path and can drop, reject, or rewrite matching flows in real time.

• An org mirrors the corridors between VLANs to Suricata and sees lateral movement the edge firewall never would.
• A payment network runs its IPS in alert-only mode first, reviewing two weeks of hits before enabling drops.
• A SOC tunes out a noisy signature family that was flooding the queue, keeping true positives visible.

• Baseline for two weeks in alert-only before you insert the IPS into the drop path.
• Route decryption/SSL-visibility where policy allows so encrypted traffic is not a blind spot.
• Alert on flow-level things (long connections, unexpected egress) — they survive encryption changes.
• Feed alerts to a SIEM or dedicated tool with host context; raw IDS output is unreadable at scale.

• Enabling every signature, drowning the team in false positives until alerts are ignored outright.
• Running the IPS inline without redundant/bypass switching, making a sensor reboot a full outage.
• Expecting signatures to catch everything while TLS and QUIC hide the payload from the sensor.
• Copying a rule set without testing it against your own baseline first.

• Use tcpdump on the mirror port to confirm the sensor is even seeing the traffic it should alert on.
• Check alert timestamps against the packet's own timestamp to spot clock skew between sensor and SIEM.
• When a new deployment is silent, capture a known-bad flow you generated in your lab and verify the rule fires.

• Only monitor links you own; 'testing' against others' traffic without authorization is illegal and unethical.
• Alerting is surveillance — define which data is captured, who may read it, and retention limits.
• IPS dropping is a mitigation, not a defense: tune, then validate with incidents, not guesswork.