I would like to know the difference between WAF and IPS/IDS? Can IPS/IDS handle an attack on a web application? If there are differences functionally between the two applications, how they work together when there is an attack?

  • You need to think about this difference in terms of the layers that they work on. IDS is lower in the stack. WAF is at the top of the stack.
    – schroeder
    Commented Jul 11, 2018 at 8:38

1 Answer 1


As @schroeder says, the largest difference is where they sit in the stack. Let's talk about that difference.

The Web Application Firewall works at the Application layer. That implies that it is dealing with the data stream, not the network stream, after it's been received by the host. As a result, it's usually applied after decryption*, so it's got full access to the request and response header and body. And a WAF can generally be expected to focus on application-specific signatures, more so than an IDS/IPS. WAF is also more likely to look at things like JSON or XML format validation; looking for things that aren't right instead of just looking for things that are wrong.

The IDS/IPS, on the other hand, operates at the network layer. While decryption is possible in some configurations, it is not assumed, the way that it is with a WAF - and if there's no decryption, the IDS/IPS may be largely blind to Web Application attacks. The IDS/IPS is able to analyze all the network layers, allowing it to look for things like fragmentation attacks that a WAF will never see. And because the IDS/IPS is expected to watch all traffic, it's not limited to web application protocols, but has a much broader spectrum of signatures. By extension, it may not have as detailed a set of Web Application signatures as a WAF.

The two technologies are intersecting sets - in an attack, some traffic will trigger both the WAF and the IDS/IPS; some will only trigger the WAF; some will only trigger the IDS/IPS. (And some will fly past both with flying colors - who says there ain't no easy run?)

*Sometimes the WAF is on the actual application server; sometimes it's a man-in-the-middle device. Either way, it will decrypt before analysis, and re-encrypt afterwards if it still has a hop to go to get to the box.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .