An inline IPS restarts while an intruder's session is open -- what can it judge about that flow when it returns?

## What an inline engine holds per flow When a connection starts through an inline box, the engine builds state that everything afterwards depends on: - the five-tuple and the direction of each side, learned from the handshake; - the TCP sequence baseline, so it can tell an in-window segment from a spurious one and can order what it receives; - reassembly buffers anchored on those offsets, so a request split across segments can be evaluated as one thing rather than as fragments; - protocol parser state -- this stream is HTTP and here is the request line; this stream is TLS and here is the ClientHello, its SNI and the negotiated ALPN; - decisions already taken about the flow, which later rules build on. ## What a restart destroys, and what it does not A restart does **not** lose the rule set, the configuration or the box's identity. Those reload intact, which is exactly why the wrong answer is so easy to give: engineers say 'it comes back and resumes inspecting', and in a narrow sense it does -- packets reach rules again. What is gone is the **per-flow** state above, and it cannot be recovered, because the bytes that would have built it already crossed the wire and will never be sent again on that connection. So for a flow that was open across the window, the engine's first observation is something like an acknowledgement in the middle of a stream: no SYN, no ClientHello, no request line, empty reassembly, unknown offsets. ## Adopt or drop That leaves a policy choice with two honest options and no third: **Adopt.** Track the flow from wherever you joined it and evaluate the remaining bytes. Cheap for availability -- nothing breaks -- but a large class of rules is now structurally unable to fire, because they key on bytes that already crossed. A quiet flow is not a clean flow; it is an unexamined one. Adoption also forces the engine to relax its sequence checking, since it never saw the baseline, and that relaxation is itself a place where injection and desynchronisation tricks live. **Drop.** Cut every flow you cannot judge from the start. Clients reconnect and the new connections are inspected properly. Correct, and expensive in exactly the wrong place: at a branch with no local hands, the sessions that survive a maintenance window are the long ones -- a file transfer, a till or database link, an operator's remote session -- and cutting them turns a silent security decision into a support call. The useful refinement is to make the choice per segment rather than per box, on reconnection cost. Where clients reconnect for free, drop. Where a cut costs a business flow, adopt -- and record which flows you adopted, so that afterwards you can name them as unjudged rather than assume them clean. ## Why this is the intruder's window, not just an inconvenience An adversary who is already inside is holding long-lived connections, because that is what interactive access and a command channel look like. Those are precisely the flows that survive a reboot and get adopted. The result is uncomfortable and worth saying plainly in an interview: the traffic most likely to matter is the traffic least likely to be judged after the box comes back. The engine did not fail; it was simply never shown the beginning. There is a second-order version too. An intruder who knows a window is coming has no need to do anything clever: existing sessions carry them through it, and anything new they start inside the window crosses a closed relay with nothing evaluating it at all. ## What you can still say Upstream flow records still exist for the whole period. They carry the five-tuple, packet and byte counts and timestamps, and no payload, so they let you list the connections that spanned the window and how much moved on each -- never what moved. Combining that list with the engine's own view of which flows it adopted mid-stream is the closest thing to an honest account of what was never judged. ## The interview answer in one line The engine comes back with rules but without context, and context is what most rules match on. Decide in advance whether you would rather be blind or break connections, decide it per segment, and be able to say which flows you were blind to.