That is exactly what it is good for.
The sensor is an inrusion detection device.
It detects that an attack is in progress and notifies you.
For many years, notification was the primary role of the ids device.
Users had no idea when they were under attack. So the IDS devices initial role was to notify the user that an attack was underway and the user would then decide what steps needed to be taken.
The ids sensor can be compared to the alarm system on your house. The alarm won't prevent a burglar from getting into your house. It just notifies the alarm company so they can call you and/or the police to go and see what caused the alarm.
It has only been in the last year or so , that there has been a concerted effort in the industry to move from detection (with notification) to prevention (stopping the attack). Where the sensor would not only detect but would actually prevent the attack by dropping the packets before they get to the end device being attacked.
This is because the ids sensors are now becoming fairly reliable at detecting real attacks and not false alarming on activity that is normal in the network. The fear had been that the IDS would see normal traffic, think it was an attack, and incorrectly drop the packets causing major problems for the users. Only in the last year or so have users become confortable with the accuracy of the IDS sensors and are willing to operate them inline.
(Note: Of course there were some early adopters who were willing to take the risk as early as 2 or 3 years ago, but only in the past year or so has the general user been willing to make the step).
This prevention capability is often referred to as inline ids.
This is because it requires that the offending packet be transmitted through the sensor (hence inline), instead of just being copied to the sensor. When the sensor is receiving a copy of the packet there is nothing it can do to the original packet. But when the sensor is acting on the original packet as it passes through the sensor, then it can drop the original packet and prevent it from getting to the end system.
At this time Cisco offers 3 types of sensors that offer inline ids (intrusion prevention) capability.
1) The ids capability inside the IOS Firewall feature set for IOS Routers. (NOTE: This IDS capability is built into the IOS image itself, and should not be confused with the NM-CIDS which is ids module for the router that does not have inline capability)
2) Similar ids capability inside the Pix Firewall. (NOTE: Just like IOS IDS, the ids is built into the firewall image itself).
NOTE Both the ios ids and Pix ids features offer a subset of the signatures in the ids appliances and modules.
3) Cisco Security Agent which is a host based intrusion prevention product. It is software installed on the end host rather than on the network device. The packet still gets to the end system, but the CSA analyzes the packet and can drop it before it makes it to the other applications on the system.
The Cisco IDS Appliances and Modules do not currently opperate in an inline mode (intrusion prevention).
I can not comment on what future versions of the Appliances and Modules may or may not be capable of on an open forum like this.
Please contact you Cisco Sales Representative if you would like to know more about the future versions of the IDS appliances and modules.
AS a side note: As I stated in my earlier email, the sensor can not drop the offending packet, but it does have other response capabilities which can prevent additional attacks. The TCP Reset can be used to stop the current connection, and prevent a further attack in that connection. (The attacker may still create a second connection to continue the attack). The Block feature can be used to stop All traffic to and from the attacker ip address. This will stop further attacks on the existing connection as well as prevent new attacks from that IP address when blocks are properly implemented.
