I have tried out various network-based IDS and IPS systems throughout the years and have never been happy with the results. Either the systems were too difficult to manage, only triggered on well-known exploits based on old signatures, or were simply too chatty with the output.
In any case, I don't feel they provided real protection for our network. In some instances, they were harmful due to dropping valid connections or just plain failing.
In the past few years, I am sure things have changed, so what are the recommended IDS systems these days? Do they have heuristics that work and don't alert on legitimate traffic?
Or, is it just better to rely on good firewalls and hardened hosts?
If you recommend a system, how do you know it's doing its job?
As some have mentioned in the answers below, let's also get some feedback on host intrusion detection systems as they are closely related to network-based IDS.
For our current setup, we would need to monitor two separate networks with a total bandwidth of 50mbps. I am looking for some real-world feedback here, not a list of devices or services capable doing IDS.