How can IDS run on a port? Does it server as intermediary between the attacker (connection) and a process? If it runs on some random port "as a process" how can it then "see" all the other connections made to other ports?