What type of filtering do IDSs do?

• A. Deep packet inspection
• B. SPI filtering
• C. Both A and B
• D. Neither A nor B

Answer: (A)

Intrusion detection systems monitor traffic by looking inside the packets, not just at header fields. This capability, called deep packet inspection, lets the IDS decode and inspect application-layer data, search for known attack signatures, and observe suspicious protocol behavior within the payload. Many threats hide in the content of packets or rely on specific data patterns, so examining the payload is essential for detection. Stateful or SPI filtering, which tracks if a sequence of packets forms a valid connection, is more about connection state than content analysis and is typically associated with firewalls rather than IDS. Therefore, deep packet inspection is the best answer.