## IDS vs IPS: Architecture & Strategy

**IDS (Intrusion Detection System)**: The Security Camera. It watches and alerts (Passive).
**IPS (Intrusion Prevention System)**: The Bouncer. It watches and BLOCKS (Active).

### Architecture Deployment
*   **Out-of-Band (IDS)**:
    *   Connected via a TAP or SPAN Port (Mirror).
    *   It sees a *copy* of the traffic.
    *   *Pro*: If the IDS crashes, network traffic continues (Fail-Open).
    *   *Con*: It cannot stop a single packet, it can only send a "Reset" (TCP RST) packet to try and kill the connection, which often fails against fast attacks.
*   **In-Line (IPS)**:
    *   Sit directly in the wire (Cable A -> IPS -> Cable B).
    *   *Pro*: Can drop packets instantly. 100% prevention.
    *   *Con*: If the IPS crashes or gets overloaded, the internet goes down for the whole company (Fail-Closed).

### Which one to use?
*   **Core Core**: Usually IDS. You don't want to risk blocking the CEO's email.
*   **Edge**: IPS (Firewall). Block known bad stuff aggressively.