Security monitoring: Which task is NOT performed by an intrusion detection system (IDS)?

Introduction / Context:
An intrusion detection system (IDS) observes activity to detect malicious behavior. It can operate on hosts or networks, analyzing logs, processes, or packet streams to flag anomalies and known attack signatures.

Given Data / Assumptions:

• IDS focuses on detection, alerting, and sometimes limited response.
• Routing and packet forwarding are functions of network devices (routers, switches), not IDS.
• Some solutions include deception components (honeypots) to study attacker behavior.

Concept / Approach:
Distinguish between security monitoring (observe, detect, alert) and transport functions (forwarding packets). IDS tools like Snort/Suricata analyze traffic but do not act as routers.

Step-by-Step Solution:

Verification / Alternative check:
Product documentation for IDS solutions shows packet capture and analysis roles, not forwarding decisions beyond passive monitoring.

Why Other Options Are Wrong:

• Detection, monitoring, and alerting are central IDS functions.
• Deception components may be integrated in broader security platforms.

Common Pitfalls:
Confusing IDS with IPS (intrusion prevention system). IPS may drop or block traffic but still does not replace routers.

Final Answer:
Transmit message packets to their correct destination (routing).