Network and Perimeter Hacking · Topic 8 of 9
IDS, IPS, Firewalls and Honeypots, and IDS Evasion
IDS, IPS, firewall and honeypot types with example products, then how attackers evade an intrusion detection system and how defenders respond.
- 5 min
- Includes a diagram
- IDS alerts. IPS blocks and sits in line.
- Signature detection misses new attacks. Anomaly detection gives more false positives.
- Honeypots are low, medium or high interaction.
What it is
An intrusion detection system (IDS) watches traffic or hosts and raises alerts. An intrusion prevention system (IPS) sits in line and blocks. A firewall enforces rules about which traffic may pass. A honeypot is a decoy system that has no business use, so any contact with it is suspicious.
These are the controls an attacker has to get past. The exam asks which control does what, and how evasion works against detection.
How it works
Concepts
| Control | Placement | Action |
|---|---|---|
| Network IDS (NIDS) | On a mirror port or tap | Alerts only |
| Host IDS (HIDS) | On a server or endpoint | Watches logs, files and processes |
| IPS | In line | Blocks or drops malicious traffic |
IDS detection methods:
- Signature based: matches known patterns. Accurate for known attacks and blind to new ones.
- Anomaly based: compares activity with a baseline. Can detect new attacks but produces false positives.
- Protocol anomaly: flags traffic that violates the protocol standard.
A false positive is an alert on harmless traffic. A false negative is a missed attack, which is usually the worse outcome for security.
Firewall types:
| Type | How it decides |
|---|---|
| Packet filtering | Addresses, ports and protocol, one packet at a time |
| Circuit level gateway | Checks the TCP handshake and session validity |
| Stateful inspection | Tracks connection state across packets |
| Application level (proxy) gateway | Inspects the application protocol |
| Next generation firewall (NGFW) | Adds application awareness, user identity, IPS and threat feeds |
| Web application firewall (WAF) | Protects web applications from attacks such as injection |
A DMZ (screened subnet) holds public servers between the outside and inside firewalls. A bastion host is a hardened system exposed to the outside.
Honeypots are classed by interaction: low interaction (emulate a few services), medium, and high interaction (real systems with real services, more risk and more information). Pure honeypots are real production-like systems. A honeynet is a network of honeypots.
Solutions
| Category | Examples |
|---|---|
| IDS and IPS | Snort, Suricata, Zeek, OSSEC, Wazuh |
| Firewalls | Cisco ASA and Firepower, Palo Alto, Fortinet, pfSense, iptables and nftables on Linux |
| Honeypots | Honeyd, KFSensor, Cowrie (SSH and Telnet), Dionaea (malware collection), T-Pot |
A Snort rule has a header and options. The following rule alerts on TCP traffic from any address to port 80 on one network, and is valid Snort syntax:
alert tcp any any -> 192.168.1.0/24 80 (msg:"Web access"; sid:1000001; rev:1;)The header holds the action, protocol, source and destination, and the options in brackets give the message and rule ID.
Evading an IDS
Evasion works by making traffic look different to the IDS than to the target, or by hiding it from inspection. Attackers use these ideas, and defenders need to recognize them.
| Idea | Description | Defense |
|---|---|---|
| Fragmentation and session splicing | Splitting an attack across many small packets or fragments so no one packet matches a signature | Reassemble fragments and streams before inspection |
| Obfuscation and encoding | Hiding content in Unicode, hex or other encodings | Normalize input before matching |
| Polymorphic code | Changing the form of malicious code so signatures fail | Behavior analysis |
| Encryption and tunneling | The IDS cannot see inside encrypted traffic | TLS inspection, endpoint monitoring |
| Insertion and evasion attacks | The IDS accepts packets the target rejects, or the reverse | Make the IDS mirror the target's handling |
| Slow and low scanning | Spreading probes over a long time to stay under thresholds | Long term correlation |
| Denial of service on the IDS | Overloading the sensor so it drops packets | Capacity, tuning, redundancy |
A worked example
A signature looks for a harmful string in a web request. An attacker sends the same request with characters percent encoded and split across packets, and no alert fires. The defense is normalization and stream reassembly in the sensor, plus a WAF that decodes the request.
How the exam asks about this
- "Which IDS method can find a new attack but often produces false positives?" -> Anomaly based detection.
- "Which firewall type tracks connection state across packets?" -> Stateful inspection firewall.
- "A system with no production use that records any contact is called what?" -> A honeypot.
What to remember for the exam
- IDS alerts. IPS blocks and sits in line.
- Signature detection misses new attacks. Anomaly detection gives more false positives.
- Honeypots are low, medium or high interaction.
- Snort, Suricata and Zeek are IDS tools. Cowrie and KFSensor are honeypots.
- Evasion techniques include fragmentation, encoding, encryption, polymorphism and slow scans.
A false negative (missed attack) is usually more dangerous than a false positive. Questions about tuning often want fewer false negatives.
Common mistakes
Treating an IDS as prevention. An IDS only alerts unless it is deployed as an IPS.
Assuming a firewall inspects content. Packet filters look only at headers.
Thinking honeypots protect real systems directly. They gather intelligence and distract attackers.
Check yourself
What is the difference between an IDS and an IPS?
An IDS detects and alerts, while an IPS sits in line and blocks.
Why does fragmentation help evade a signature based IDS?
The signature is split across packets, so no single packet matches unless the sensor reassembles them.
What is a high interaction honeypot?
A real system with real services that gives rich data but carries more risk.
Topic 8 of 9 in Network and Perimeter Hacking
Test yourself on Network and Perimeter Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.