Hot answers tagged ids
Based on the description of fwsnort it is a packet level IDS using the iptables string matching feature. This means that it can not apply any rules which span multiple packets. This includes any serious application level analysis like looking into SMTP (mail) and HTTP (web) traffic. Thus if you care mostly about attacks at the lower layers it might be ...
In IDS in the classical sense is passive (D for detection) and can not drop a packet. In IPS instead (P for prevention) can drop the packet and better should do it. But the usage of the words IDS, IPS, firewall etc is too vague today that it is not clear which kind of technique you are talking about.
Only top voted, non community-wiki answers of a minimum length are eligible