cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1990
Views
0
Helpful
2
Replies

Network malware scanner vs IPS

Hello, 

I confused these days about the difference between Network malware scanner and the IPS.

For example - Cisco doesn't have integrated malware scanner in the NGFW, but some vendors have. What is the purpose of having IPS and malware simultaneously? The only thing i can think about is malware scanners can fix infected files (on IronPort ESA for example) and IPS directly drops traffic.

1 Accepted Solution

Accepted Solutions

jason.loera
Level 1
Level 1

An IPS scans packets whereas a malware scanner scans files. With the Cisco IPS, you can configure in either promiscuous or inline modes. In inline mode, the IPS can identify and drop malicious packets before they're unleashed on the network. In promiscuous mode, a copy of each packet is sent to the IPS and malicious packets are identified after they arrive at their destination. This means viruses, malware, etc. can potentially be activated on the network.

A network malware scanner scans for already installed malware. For instance, if a new flavor of malware is sent as an attachment to an email address on your network, the IPS will not pick it up since it doesn't have a signature for it. If the attachment is opened, it's unleashed. If you have periodic scans done with your network malware scanner, this is something it'll pick up.

Jason

View solution in original post

2 Replies 2

jason.loera
Level 1
Level 1

An IPS scans packets whereas a malware scanner scans files. With the Cisco IPS, you can configure in either promiscuous or inline modes. In inline mode, the IPS can identify and drop malicious packets before they're unleashed on the network. In promiscuous mode, a copy of each packet is sent to the IPS and malicious packets are identified after they arrive at their destination. This means viruses, malware, etc. can potentially be activated on the network.

A network malware scanner scans for already installed malware. For instance, if a new flavor of malware is sent as an attachment to an email address on your network, the IPS will not pick it up since it doesn't have a signature for it. If the attachment is opened, it's unleashed. If you have periodic scans done with your network malware scanner, this is something it'll pick up.

Jason

Thank you for the answer, Jason!

And the malware scanner is working only on specific ports - 80, 443, 25...

I think it is more clear for me now.

Best regards!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: