What does NIDS stand for?
NIDS stands for Network-based Intrusion Detection System. A network-based intrusion detection system that analyses traffic on the segments where its sensors sit, usually from a SPAN port or tap, and alerts on suspected attacks without blocking them.
A NIDS is a sensor that receives a copy of network traffic, usually from a mirrored switch port or a network tap, and analyses it for signs of attack. It can watch many hosts at once without installing anything on them, including printers, cameras and other devices that cannot run an agent. It has two blind spots: it cannot read the content of encrypted sessions unless they are decrypted first, and it sees nothing of what happens inside a host.
NIDS in practice: an example
A sensor connected to a tap on the link between the core switch and the firewall sees one workstation contacting hundreds of internal addresses on the same port within a minute. The pattern matches a scanning rule and the NIDS raises an alert naming the workstation. Nothing is blocked, because the sensor only received copies of the packets.
What NIDS is confused with
NIDS vs HIDS: what is the difference?
A NIDS analyses traffic on the wire for a whole segment. A HIDS analyses files, logs and processes on a single machine. What HIDS stands for
NIDS vs NIPS: what is the difference?
A network-based intrusion prevention system sits inline and can drop traffic. A NIDS works on a copy and can only alert.
NIDS vs IDS: what is the difference?
IDS is the general term. NIDS and HIDS are its two placements: on the network or on a host. What IDS stands for
Which exams cover NIDS?
NIDS is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: 4.1 (Security Operations).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A company needs to detect attacks against network printers and cameras that cannot run security software. What should it deploy?
- A HIDS agent on each device
- A NIDS sensor on the segment those devices use
- Full-disk encryption
- A password manager
Show the answer
B. A NIDS sensor on the segment those devices use. Devices that cannot run an agent can still be monitored from the network. The sensor needs no software on the monitored devices.
2. Why might a NIDS miss an attack carried inside a TLS session?
- TLS traffic never crosses switches
- The sensor cannot inspect payloads it cannot decrypt
- TLS uses UDP only
- A NIDS inspects only wireless traffic
Show the answer
B. The sensor cannot inspect payloads it cannot decrypt. Without decryption the sensor sees addresses, ports and sizes but not the content, so content-based signatures cannot match.
Sources: NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems; NIST glossary: network intrusion detection system. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.