I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?

2 Answers 2


Neither of these technologies can prevent a DDoS attack, what they can do is help to prevent a DDoS attack from taking down services. They have completely different functions so you can't say one is better is better than the other.

An Intrusion Prevention System looks for anomalous traffic on a network and can alert operations staff that a DoS attack is underway, and in some cases it may be able to block some of the traffic. The main benefit here is the alerting capability though, notifying operations people so they can swing into action and keep services up.

A Web Application Firewall will, if configured properly, filter DDoS traffic before it overwhelms the applications behind it.

In reality, unless the DDoS attack is pretty low-level neither is going to be that much help, as a powerful DDoS attack will overwhelm both. The most effective DDoS protection is at the perimeter of your network, using traffic filtering and rate limiting on your border network devices. It also helps to have a plan in place to contact your upstream ISP and ask for their help in filtering the DDoS traffic.


So first lets look at these two. A Web Application Firewalls, as the name implies, work with web applications almost exclusively. Most WAF are often not best-of-breed traditional firewalls, and should not be implemented in place of a traditional network firewall. Typical WAF deployments feature SSL decryption of web application traffic and blocking of web-based threats after the WAF reassembles each web session. This is possible because the WAF operates at the application layer where HTML, XML, Cookies, Javascript, ActiveX, Client requests, and Server responses live.

Intrusion Prevention Systems, as the name implies, inspect packets in an attempt to prevent attacks and therefore intrusions. IPS, which evolved from Intrusion Detection Systems, are packet inspection systems that analyze traffic for signatures or policy violations. These all-purpose devices typically do not decrypt encrypted traffic but instead apply a predefined policy or signature set across all network traffic presented to the IPS.

As packets are inspected by an IPS, they are often discarded to improve performance. This is a key differentiator, because a WAF must retain packets in order to keep the context of a client web request and the subsequent server response. Thus you could say that IPS’s deal with packets, while WAF’s work within sessions.

WAFs must understand not just protocol behavior, like HTTP GET, POST, HEAD, etc, but also JavaScript, SQL, HTML, XML, Cookies, etc. This application layer logic is fundamental to the operation of a WAF but not required for IPS functionality, and therefore not typically implemented on an IPS.

Baselining is available on IPS and WAF, but the similarity stops with the name. IPS baselining consists of statistical deviations in throughput and traffic flows. WAF baselining involves URL, Parameter, HTTP Method, Session, and Cookie mapping. A WAF knows no concept of bandwidth utilization for baselining, just an IPS doesn’t know if a given URL is supposed to accept HTTP POSTs or GETs.

WAF deployments are focused on web applications and web application traffic, while IPS deployments are typically done at the network level inspecting all packets. I’ll grant you that there are Host-based protections are blur the lines of IPS and WAF, but these don’t qualify as IPS or WAF and probably won’t be living in large multi-OS datacenters or deployed across the tiers of your n-tiered applications.

These are complimentary technologies, just as traditional firewalls and IPS compliment one-another. Brute Force Protection is a set feature but in some cases a DDoS attack would or should I say "could" be mitigated at Layer 7.

Never the less, the overhead associated with the inspecting web sessions and processing the resulting event volume is enough to tax most dedicated WAF hardware, but to implement this same amount of workload on an IPS that is having to work at wire-speed, protecting ALL network traffic, is likely to degrade the IPS performance and jeopardize security protection. Its not really the best method or should it be our first line of defense when looking at a possible DDoS that could take your whole network down or at most your Edge Net.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .