1. An IDS is a security countermeasure. It monitors things looking for signs of intruders. Contrast: A host-based IDS monitor system events, logfiles, and so forth. A network-based IDS monitors network traffic, usually promiscuously. Contrast: A firewall simply blocks openings into your network/system, but cannot distinguish between good/bad activity. Therefore, if you need to allow an opening to a system (like a web-server), then a firewall cannot protect against intrusion attempts against this opening. In contrast, intrusion detection systems can monitor for hostile activity on these openings. More: See http://www.robertgraham.com/pubs/network-intrusion-detection.html for more info. From Hacking-Lexicon