Intrusion Detection System (IDS)

mgmguy1

I am so confused on this. IDS (Intrusion Detection System ) is designed to inspect and detect the kinds of traffic or network behavior patterns that match known attack signatures or that suggest potential unrecognized attack that may be incipient or in progress
What I am trying to understand is how do a Application fire wall differ from an IDS software package ?

Please advise, MY Network plus book does not do a good job in explaing the deiiference.

sprkymrk

You may be confised by the large number of "do-everything" appliances and firewalls out there today. Many firewalls have some IDS/IPS functions built in, and some IPS devices have firewalling functions that are activated upon bad traffic detection.

An application firewall handles traffic at layer 7 protocols (in general terms - I would like to avoid another lengthy discussion of the OSI model and things that cross layer boundaries) instead of just examining packet headers and port numbers, etc. An IDS can operate at the same layer (some do, some don't) but is looking, as you say, for signature matches and then alerts you based on your configuration settings in the IDS itself. A firewall that works at the application layer uses rules/acls based on the configuration to either allow or drop traffic.

Short answer:
Application firewall uses rules to allow or drop traffic.
IDS uses signatures or hueristics to log and alert.