A stateful inspection firewall keeps a table of active sessions and permits return traffic belonging to connections it has already seen.

A packet-filtering firewall tracks the state of each connection, which is why it resists IP spoofing better than stateful inspection.

A HIDS runs on an individual host and can detect local file tampering that a network sensor on the segment would not see.

Because a correctly configured firewall enforces the traffic policy at the perimeter, intrusion detection inside the network becomes unnecessary.

A false negative - a real attack that goes unnoticed - is the more dangerous of the two error types.