CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.4  Intrusion Detection            9  3.4.1  Network Based

3.4.1  Network Based 1 3.4.1.2  Passive Detection

NIDS are increasingly focusing on active detection. This does not refer to how the NIDS detects potential problems, as you might expect. Instead it refers to how the NIDS responds to the situation once it is detected. (Sorry folks, this is the industry standard terminology. We didn’t create it.) With active detection, the NIDS takes some action to mitigate the detected threat. Such options can include:

• Reconfigure a firewall or router to route traffic around a problem such as a DoS attack
  
  
• Break suspicious network connections
  
  
• Send a message to a host-based agent to shut down a vulnerable service on a particular host
  
  
• Attempt to collect more information about the intrusion

3.4.1  Network Based 1 3.4.1.2  Passive Detection