Network-based Intrusion Detection System (NIDS)

A network-based intrusion detection system, or NIDS, monitors traffic within a network segment for indications of attacks. Analysis takes place centrally, usually via a mirror port on a switch or a network TAP, so that productive traffic remains unaffected. Packet headers and payloads are evaluated using signatures of known attack patterns, protocol analysis and anomaly detection. Detected incidents are logged and reported to a SIEM or monitoring platform. Unlike host-based systems, a NIDS observes traffic from multiple devices simultaneously, but has no visibility into encrypted connections without prior decryption. Well-known solutions include Snort, Suricata and Zeek. Placement, rule maintenance and consistent analysis are decisive for effective monitoring.