IPS prevents intrusions by sitting inline on a link (the answer to your second question), blocking traffic (read: not passing it from one interface to the other) that meets specific criteria. If you think of the IPS as a border crossing, the signatures would be analogous to the guard at the gate who is denying you access until they’ve looked at your passport (the IP and TCP/UDP headers, for example) and inspected the trunk of your car (the data payload).
In Cisco IPS land, any traffic that causes a signature to fire, where that signature is configured to block, will be blocked. This is better than "reactive IDS" (the lexicon for what you asked about in your third question) because it can be instantaneous, instead of in a delayed response to traffic that matches a signature.
"Reactive IDS", that is an IDS sensor configured to reconfigure an ACL on either a router or firewall (so the answer is "yes" to your fourth question...) in response to specifically configured signatures being triggered, is different from IPS because of the delay the architecture inherently introduces.
It is far faster for an inline device to stop a malicious IP datagram or TCP/UDP packet than trying to do the same via reactive IDS. The IPS stops it right then and there, where as the IDS puts roadblocks in place as a result of something bad happening. Unfortunately, the evil activity may already have occurred before the IDS can reconfigure the router/firewall it has a partnership with as a result. Even if you now block all traffic from the offending source IP address for 30 minutes, it does very little to prevent the potentially exploited destination IP address from posing a threat to your protected network. In essence, it's about as effective as closing the barn door after the horse has already ran off...
Case in point, a single-packet buffer overflow attack can cause a host to open a reverse shell. If an IPS intercepts this packet, the host never receives the attack because it is blocked (assuming of course that there is a signature matching the attack and that signatures settings allow it to block). If an IDS using the reactive features sees this packet, it will have the router/firewall it controls put an ACL in place blocking all further traffic where the source IP address matches the one that triggered the alarm. This does nothing to stop the host that received the packet containing that buffer overflow from pushing the reverse shell contained in the attack back out. The wily attacker will just configure the attack to use the IP of another system they control to receive that shell, bypassing any ACL the IDS caused to be thrown into place as a result of the attack.
I hope this clarifies. On the surface, the two concepts are similar. Ultimately, however, they are worlds apart. IMHO, Cisco’s efforts with “reactive IDS” provided the foundation upon which the current IPS products where built.
I hope this helps,
Alex Arndt
