Which of the following is a reasonable response from the ids when its detects ip packets where ip source address and port is the same as the destination IP address and port

A. Allow the packet to be processed by the network and record the event B. Record selected information about the pockets and drop the pocket


In IDS in the classical sense is passive (D for detection) and can not drop a packet. In IPS instead (P for prevention) can drop the packet and better should do it. But the usage of the words IDS, IPS, firewall etc is too vague today that it is not clear which kind of technique you are talking about.

  • This is one of the CISSP question, The way i see it is the option A. But book says its Option B as the right answer. Therefore is there a way for IDS to drop the packets? I mean any configuration etc – PCIrs Nov 5 '15 at 10:07
  • @PCIrs: I think my answer is quite clear that an IDS in the classical sense can not drop packets (passive only) but that the meaning of the words is so vague today that they could mean with IDS also IPS or firewall which both can drop packets. That's the difference between detection only and prevention. – Steffen Ullrich Nov 5 '15 at 10:17
  • Thanks for your comments, it may make sense if they mention IDS with a FW or not like fortigate etc – PCIrs Nov 5 '15 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.