Network-Based IDS (NIDS)

A Network-Based Intrusion Detection System (NIDS) receives a mirrored or tapped copy of network traffic — via SPAN ports, network TAPs, packet brokers, or virtual taps — and analyses it with signatures (Snort/Suricata rules), protocol decoders (Zeek), and statistical models. NIDS deployments give broad visibility into many hosts without per-endpoint software, are useful for north-south and east-west monitoring, and are foundational sensors for SOC and threat-hunting teams. Because TLS encrypts much of today's traffic, NIDS increasingly relies on TLS metadata, JA3/JA4 fingerprints, and behavioural flow analytics. Effective use requires careful tap design, capture sizing, accurate clock sync, and integration with SIEM and NDR pipelines.