these are used to monitor a network for suspect activity.
device or software application that monitors a system or network and analyzes the data passing through it in order to identify an incident or attack
deep inspection of application messages across multiple packets to identify malicious activity