I'm not trying to solve a current technical problem but I came across this and have been wondering how it's done. Intrusion Prevention Systems are supposed to let all network traffic pass through and implement Intrusion Detection methods to detect and stop packets with malicious payloads. I would think that an IPS does not on it's own create any answer message (that could be used to fingerprint it) but rather either passes the packet or not. Then how can it be "fingerprinted"?
Perhaps a very first suggestion would be to send specifically crafted packets to a (e.g. web) server you know is connected beyond the IPS and based on the server's answers to infer on the IPS engine/rules. But is this practical? Is there a "proper" way to do it?