Protocols such as IP, TCP, UDP, ICMP, and RPC, according to Juniper networks could potentially be useful for IDS objectives of determining the direction and test conditions. In a way, protocol anomaly-based IDS is considered more practical than other methods as it uses available basic TCP header data and other attributes. Is this approach really practical in reality?
The problem IDSes face today is encryption. Once you receive a stream of encrypted information, you can only try to make sense of its behaviour.
They rely on defaults (a default port or protocol for a service), on well-known endpoints and on some pre-encryption activities (handshakes for instance).
So I would say that it is more one of the few possibilities left today, rather than being "more practical".