Network intrusion detection watches packets on the wire and alerts when traffic patterns suggest scanning, exploitation, or data theft.
It is a traffic sensor with an alert as its output, which is narrower than every control that happens to sit on a network.
How it works
The sensor may receive a copy of packets from a mirror or may see them from a position that does not have to be the only forwarding path.
It looks for signatures and strange patterns in that traffic and then notifies people, leaving the decision to block for a different control.
Encrypted flows limit what the sensor can read, so it may see only addresses, sizes, and timing unless the organization terminates encryption in front of it.
That limit is a reason to place host detection beside it, not a reason to pretend the wire view sees inside every session.
Concrete examples
- A sensor on the server segment alerts when one internal address probes administration ports across dozens of hosts in a minute.
- A large nighttime transfer to an unfamiliar external address raises an alert that the data loss process then reviews.
- A lab mirror port shows a vulnerability scanner the security team forgot to schedule, and the alert is closed as authorized.
Protective measures
- Place sensors where copies of important traffic actually arrive, and test that a sample attack pattern in the lab produces an alert.
- Keep signatures current and retire noisy ones that train the team to ignore the console.
- State clearly that this sensor alerts and name the separate control if you also want sessions stopped.
- Pair the wire view with host logs where encryption hides the payload you would need to judge intent.