Sometimes firewalls are mis-configured and sometimes previously unknown vulnerabilities crop up in software. Even heavily defended networks are sometimes penetrated, and an IDS is a key component and an important tool in computer and network security . The IDS field is still in its infancy and developing rapidly and there are many important issues surrounding the selection and use of an IDS, even experts in the field don't fully agree . There are currently over 60 different products, these vary between commercial products, products developed at government labs and by the military, and tools that are the result of research and development efforts by the academic community. Some are more refined than others, some more effective, some are free, some cost a lot of money, some are manpower intensive.
Network based systems monitor the traffic on the network in an attempt to detect an intrusion.
Aside from the types of IDS, there are two basic methods of detection, anomaly based and signature based. The signature based method looks for a specific signature on a host or on a network to detect an intrusion. Typical IDS Configuration A typical IDS configuration for monitoring a network would consist of a network based system using a signature method of detection. The IDS would be installed outside the network firewall and would be configured to monitor specific services . Some services such as DNS and WWW traffic would be monitored in real-time and notification would occur as soon as an attack or penetration took place, when an initial investigation would be done to determine if a penetration had taken place.