Network analyzers are devices that monitor and analyze the network traffic in realtime, for the purpose of identifying any arbitrary violations of general policy established by the network manager. The differences among them concern the methods used for analyzing and reporting, and the type of traffic that can be identified. They are not permanent devices. In other words, they do not constitute a replacement for a firewall, a proxy, or similar devices. IDSs are installed in addition to firewalls and carry out a check at an internal level, on the customer side of the network.
Some commercial products combine the two methods.
Thus, the IDS combines the functions of a simple network analyzer with that of recognizing attacks. This is generally achieved by means of a signature check, rather like programs that detect viruses. The system contains a database of attacks, which functions as a basis of comparison with the traffic analyzed. When an attack is recognized, the IDS can stop the stream of data immediately, thereby preventing the attack from causing damage to the network. An IDS that does its job properly must also enable recording of the date, source, target, and type of the attack, and of the activity undertaken.