As an example, an attack on an encrypted protocol can't be study by an IDS. If the IDS simply cannot match encrypted visitors to present databases signatures, the encrypted visitors is just not encrypted. This can make it very hard for detectors to identify attacks. A firewall screens actively, looking for threats to circumvent them from turning