Network › Module 2 › Lesson 1
Detection vs Prevention
IDS watches; IPS interrupts — then count hits on
Visual · ids_detect_vs_prevent
Detection records a flow. Prevention tries to stop it. Original Cyberlium.
Opening
An alert is not a block. A block is not a story. Learn which job you are asking for.
People say “IDS/IPS” as if it were one appliance sticker. It is two verbs. Detection means something looked at a flow and wrote a decision: interesting, noisy, or worth a human. Prevention means something sat in the path and tried to drop, reset, or tarpit that flow before it finished. If your “security box” only emails you after the file left the building, you bought a diary, not a door. This is ORIGINAL Cyberlium Topic 11 teaching — not a vendor cert dump, not a café packet-tap kit, not permission to span a roommate’s switch.
1. Two verbs: watch the flow, or get in its way
An intrusion detection system (IDS) is a witness. It classifies traffic using signatures, anomalies, or both, then emits a record. The packet may still arrive. That is not a bug in the idea of detection — it is the contract. You accept delay and incompleteness in exchange for not becoming a single point of failure on the path.
An intrusion prevention system (IPS) is a participant. It must see the flow in time to refuse it. Inline placement buys power and costs availability: if the preventer dies closed, you look “secure” and offline; if it dies open, you look like you never bought it. Cyberlium wording: name the verb before you name the brand. Detect-only on YOUR loopback toy is still literacy. Dropping strangers on a café VLAN is not this course.
2. Placement is the hidden half of the verb
A detector that only sees a copy of traffic (SPAN, tap, host log) cannot prevent. It can still be invaluable: you learn what YOUR service was asked to do. A preventer that is not actually inline is a detector wearing a louder name. Students mix these because dashboards use the same red badges for both.
On a host you own, the honest beginner lab is: generate a request YOU sent to , append a line that says detect, and notice the HTTP answer still came back. That is detection. Prevention would be a policy that refuses the path — a host firewall lesson you already met, or an inline box you are authorized to place. This module stays on the witness.
Command guide
Placement is the hidden half of the verb
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
import socket
s = socket.socket(); s.settimeout(1.0)
r = s.connect_ex(("127.0.0.1", 8781))
s.close()
print("127.0.0.1:8781 connect_ex", r, "0=listener on YOUR host")
print("detection can log this try even when the verb is not prevent")
PYCommand — copy this
code=$(curl -sS -m 2 -o "$HOME/cyberlium-lab/t11-m02-l01.body" -w "%{http_code}" "$SAFE/" || echo "000")
grep -c "127.0.0.1:8781" "$HOME/cyberlium-lab/t11-m02-local-alerts.log"3. What this course will never call “detection practice”
Mirroring a dorm switch, running a stealth SYN scan so a campus IDS “has something to show,” or flooding a neighbor so an IPS dashboard lights up — those are attacks and trespass, not homework. Cyberlium’s sensor is a file you wrote after hitting a listener you started on loopback.
If a blog says the only way to learn IDS is to “see real malware on public Wi-Fi,” close the tab. Real operations teams instrument networks they are paid to defend. You are learning the verbs and the honesty of logs on a host you control. Keep ettercap, arpspoof, hping3 floods, and 0.0.0.0 binds out of muscle memory.
Command guide
What this course will never call “detection practice”
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ COMMANDS ═══
Command — copy this
grep "verb=detect_only" "$HOME/cyberlium-lab/t11-m02-local-alerts.log" | tail -n 3
4. What you ship: a named verb and a count of YOUR loopback hits
Write detect vs prevent in one sentence each. or STOP if it is a router. Count lines in YOUR local alert log for Do not claim prevention because a dashboard was red. Do not tap a network you do not operate.
5. What you record before the next lesson
Date (UTC). Detect = record; prevent = refuse in path. DEMO identified or STOPPED. SAFE Hit count from t11-m02-local-alerts.log. NEVER nmap/hydra/ettercap/0.0.0.0. Path: $HOME/cyberlium-lab/t11-m02-l01-detect-vs-prevent.txt chmod 600. Legal: original Cyberlium — not a vendor IDS cert.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
SPAN the café switch “to learn IDS.” nmap 192.168.0.0/24 so the home IPS has events. Hydra the TP-Link admin because 192.168.0.1 answered. Bind a sniffer to 0.0.0.0.
Right
with curl. Hit , append detect-only, count YOUR lines. Next: Signatures Anomalies and Logs.
Mission: name the verb, then count YOUR hits
1) curl http://192.168.0.1/ and decide lab-app vs router (STOP if router). 2) Write detect vs prevent in $HOME/cyberlium-lab. 3) Generate one loopback request to and count it in a local log. Never scan the LAN. Never inline-drop strangers.
Stuck? Ask Cyberlium AI Mentor
If SAFE is down, ask Mentor: “Hint only: how do I count lines in MY alert log after curl ?” — not how to tap a school IDS.
Knowledge Check
APPLY: curl http://192.168.0.1/ shows a Huawei “Router Admin” page while you are studying IDS. What do you do?
Multiple choice
Knowledge Check
APPLY: True or False: If the packet still arrives, you did not have an IDS — you failed.
True or False
Knowledge Check
APPLY: YOUR curl to returns 200 and your log gains one detect_only line. What did you practice?
Multiple choice