A sensor on a network segment watches the traffic that crosses that segment. It raises an alert when the traffic matches a signature or departs from a baseline. The sensor does not sit inside the endpoint, and it does not, by itself, block the packet.
That placement is one form of an Intrusion Detection System (IDS). The other common placement is a Host-based Intrusion Detection System (HIDS), which watches the endpoint rather than the segment.
How the Sensor Watches a Segment
Operators place the sensor where it can read a copy of the segment. A mirror of a switch port or a tap on the link supplies that copy. The sensor tests the copy, records an alert when the test fails, and leaves the original packet on its path.
- Signature. The sensor raises an alert when the traffic matches a stored pattern in the headers or in the payload it can read.
- Baseline. The sensor raises an alert when the traffic departs from the segment’s usual volume, peers, or timing.
What the Sensor Cannot Do
Reading that copy still leaves two hard limits. The sensor’s job is to raise an alert, not to stand in the packet’s path or to open traffic it cannot read.
- Encrypted traffic. It cannot see traffic that is encrypted unless it is given a copy of the decrypted stream.
- No block of its own. It does not, by itself, block the packet. A person or a separate control has to act on the alert.
Network Sensor and Host Sensor
In the table, the network sensor is the segment placement. The host sensor sits on the machine. Both raise an alert. Stopping the traffic, or the activity on the machine, takes a separate step.
| Comparison | Network Sensor | Host Sensor |
| Where it sits | On a network segment, not inside the endpoint | Inside the endpoint |
| What it watches | Traffic crossing that segment | Activity on that machine |
| When it alerts | Traffic matches a signature or departs from a baseline | Activity on that machine matches a signature or departs from a baseline |
| Encrypted traffic | Hidden unless the sensor is given a copy of the decrypted stream | Can inspect content the endpoint has already decrypted |
| Blocking | Does not, by itself, block the packet | Reports the activity. A separate control has to stop it |