What is the difference between IDS , IPS and Firewall ?

A firewall is simply just a set of filters/rules that are matched against traffic. It can only detect malicious traffic trying to enter a computer system but can not detect anything which has entered the system. A firewall is considered a first line of defense in protecting private information. For greater security IDS and IPS systems should be used along with the firewall.

An IDS (Intrusion Detection System) is passive meaning it basically sits watching packets go through the network. It has a set of rules which it matches the packets against and sets off an alarm if it detects anything suspicious, usually the administrator is alerted. An IDS can detect several types of malicious traffic that would slip by a typical firewall, including network attacks against services, data-driven attacks on applications, host-based attacks like unauthorized logins, and malware like viruses, Trojan horses, and worms. Most IDS products use several methods to detect threats, usually signature-based detection, anomaly-based detection, and stateful protocol analysis.

An IPS (Intrusion Prevention System) has all the features of a good IDS, but can also stop malicious traffic from invading the enterprise. Unlike an IDS, an IPS sits inline with traffic flows on a network, actively shutting down attempted attacks as they’re sent over the wire. It can stop the attack by terminating the network connection or user session originating the attack, by blocking access to the target from the user account, IP address, or other attribute associated with that attacker, or by blocking all access to the targeted host, service, or application.