Unsolved Security+

---

On behalf of Razmik-

I was under the impression that IPS is always in band since it should be able to prevent or apply counter measures. And IDS is always out of band since all it has to do is to detect and alert ?

@itprotvivian,

To Razmik-

The terms in band and out of band are normally terms used with the management of the devices.

In band typically refers to management of devices that are used on the same IP network it is used on. For example, I might use ssh to access the device from the data network it is used on.

Out of Band normally is a dedicated management access in which there is no other data besides management data. For example, on a Dell server, there is a DRAC (Dell Remote Access Controller) which is not on the same data network as our data

The functionality of a network device like an IPS or IDS is referred to as in line or not in-line.

• IPS are inline because they are examining every packet while it is moving across the network. They inspect, perform a deny or permit, log and alert.
• IDS examine a COPY of the traffic, while the traffic continues towards its destination. They only receive a copy and alert and log based on the copy.

Others may chime in and give you a better answer!