What to ask when evaluating intrusion-prevention systems

Computerworld - An intrusion-prevention system (IPS) is part of an overall security strategy to protect your network from attack. The IPS literally prevents an attack by blocking bad stuff, such as viruses or malformed packets, from getting into the company network.
Sitting directly behind the firewall, the IPS examines in detail all the traffic passed by the firewall, reassembles it and "scrubs" it where necessary (removing any attempts at obfuscation or evasion) and compares it to a database of known attack patterns.
This brings us to the first and biggest difficulty faced by anyone when evaluating IPS products -- how effective is the detection mechanism? Asking vendors these questions can help you decide which IPS is right for your company.
What is the coverage like?
The total number of signatures is a well-used marketing trick, but quantity isn't always an indicator of quality of coverage. Sometimes, one well-written signature can detect a large number of exploit variations. However, some vendors with hardware-accelerated products and horsepower to spare will often throw signatures at the problem, with one signature for each variation -- not always the best approach.
Does it rely purely on pattern matching, or can it perform protocol decodes?
A protocol decoder is often the best (and sometimes the only way) to detect multiple exploits for complex vulnerabilities. However, don't believe all the hype about protocol decoders. It's not always necessary to have one, and sometimes, a few well-written signatures can work just as well. (Bear in mind that even a full protocol decoder needs to use pattern or variable matching in order to determine if the protocol-specific content it has extracted is malicious).
How susceptible is it to common evasion techniques?
There are a number of readily available evasion tools out there (fragroute, Whisker, etc.) and at the very least, any IPS should be able to handle them easily. Watch out for any product that comes with IP fragment reassembly or TCP segment reassembly disabled by default. This is often done purely for performance reasons or because the reassembly is suspect. These anti-evasion techniques should always be enabled.
How likely is it that variants of the same exploit or new exploits of the same vulnerability will be detected without a signature update?
What we are looking for here is a product where the signatures are written to detect the underlying vulnerability rather than a specific exploit. This means that when a new variation of an old exploit is produced, the IPS device stands a good chance of being able to block it