ccna 4.0

ccna 4.0.5.1.2.4 Advantages and Disadvantages of IPS Network IPS has many advantages and disadvantages. One of the advantages is that a network-based monitoring system can easily detect attacks that occur across the entire network. It can clearly show the extent of attacks on the network. Also, because the monitoring system only inspects traffic coming from the network, it does not have to support every type of operating system used on the network. Network IPS also has many disadvantages. If the network data is encrypted, it is not visible to the network IPS at all, so no attacks are detected. Another problem is that it is difficult for the IPS to have time to reconstruct the fragmented traffic used for monitoring purposes. Finally, as networks utilize more and more bandwidth, placing the networkIPS in a single location to successfully capture all traffic increases in difficulty. The solution to this problem is to use more sensors throughout the network, which increases the cost.5.2 IPS Characteristics5.2.1 Characteristics of IPS Features5.2.1.1 Characterization Properties In order to stop incoming malicious traffic, the network must first be able to recognize them. Fortunately, malicious traffic shows explicit126 Chapter 5 Implementing Intrusion Preventioncharacteristics or "features". Characteristics are rules, which IDS and IPS use to detect typical intrusion activity,For example, DoS attacks. These features are used to. IPS sensors are used to identify specific worms, pathologies, protocol anomalies, and malicious traffic addresses.The features or anomalous flow hi: patterns that are matched. From a conceptual I... From a conceptual point of view, IPS features are much like the virus.dat file used by disease scanners. When sensors scan network packets, they use the features to detect L1 known attacks and respond with predefined behavior. A malicious packet stream has "specific types of behavior and characteristics. IDS and IPS sensors use very different features to detect data streams. When a sensor characterizes a data stream, it takes action, such as hitting the public with a small object or sending an alert to the IDS or IPS software.Features have 3 distinct properties: