Learn in the textbookFundamentals of Access Control and Network Defense Devices
DefinitionAn IDS (intrusion detection system) watches networks and servers and spots and reports signs of unauthorized intrusion or attack.
ExplanationAn IDS handles finding and reporting, and does not stop the traffic itself. Because it watches traffic and devices separately from the firewall that filters at the boundary, it can also notice attacks that got past the firewall and suspicious activity from inside. It can monitor either the traffic on a network or the activity on a server.
AnalogyLike a burglar alarm at home. It sounds when a window is forced open, but it does not push the intruder back out.
Memory hookD is for Detection: its job ends once the problem is found.