IDS/IPS

In alert mode a wrong match costs an analyst an hour. Inline, the identical match severs a live session. The rule's accuracy does not change - only who pays for its mistakes, which moves to whoever owns that traffic.

A hardware bypass relay shorts the two inline ports together when the engine stops, so the branch link keeps carrying packets. You buy availability with inspection: everything in that window, an intruder's traffic included, crosses unjudged.

A suppression scoped to a /16 blinds the sensor for every host in that range, not just the scanner. Any address inside it can generate the matching traffic and the sensor emits nothing.

Everything past the first megabyte of that flow leaves uninspected, so an intruder puts the payload behind a benign prefix. The limit exists because deeper reassembly costs buffer memory on every concurrent flow and adds latency.

Mirroring is best-effort: the switch copies up to the destination port's line rate and discards the rest without disrupting forwarding. At peak the sensor receives a fraction of the uplink, so an intruder's packets can simply never arrive.

Two containers on one node exchange packets inside that node's kernel, so no frame ever reaches the switch a mirror copies. Seeing that hop means running capture inside every node, paid in CPU on the machines running production workloads.

Metadata only: the five-tuple, byte and packet counts in each direction, start, duration, record sizes and timing, the client handshake fingerprint, and the SNI when it is present. The payload stays encrypted, and in TLS 1.3 so does the server certificate.

That is insertion: the sensor holds bytes the endpoint never accepted, so the attack text is padded apart and no pattern matches. Avoiding it costs the sensor a model of the path - checksums, TTL, MTU and sequence sanity, all validated as the destination would.

One byte of padding pushes the pattern past the depth window, and one changed letter defeats a match written without nocase. Widening the anchor means scanning the whole buffer on every packet and accepting more false positives, which on an inline sensor drops real traffic.

Without decapsulation the sensor matches only outer headers: the two node addresses, UDP port 4789 and the segment identifier. Every workload conversation collapses into a few node-to-node tunnels. Recovering the inner packet needs a decapsulating sensor or capture inside the node, and node-to-node encryption removes even that.

TLS 1.3 derives session keys from ephemeral Diffie-Hellman shares that both endpoints discard, and the long-term key only signs the handshake. Escrowing it decrypts nothing - and on an outbound implant session you never held that key anyway.

Walk the delivery chain stage by stage and ask each one what it counted. If the sensor's own connection record for the replay is absent or truncated, packets were lost before matching; if the record is complete with the expected byte counts, the packets arrived and the detection is at fault.

TCP does not define which copy of overlapping bytes wins, so different stacks keep different data - some the original, some the newer. A sensor several hops upstream must imitate the destination's choice, which means a reassembly policy set per address range.

The rule header - protocol, source and destination address and port, and direction - plus flow keywords are checked first. Only packets that pass reach the payload content match, so most traffic is discarded without any byte scanning.

State is held per connection and per file in flight, not per bit, so ten thousand tiny sessions cost far more table space than one large transfer. At the ceiling the sensor sheds records, not traffic.

Drop discards silently, so a device that never retries hangs and the fault looks like broken equipment. Reject answers with a TCP reset or ICMP unreachable - fast, legible failure, but it confirms to the intruder that something is filtering.

Very little. It rejoins mid-stream with no handshake, no first request and no reassembly state, so it sees packets from a conversation it never saw begin. Its midstream policy decides whether to pass that flow blind or cut it.

A threshold caps how many events a signature emits per tracking key per interval, so a sample survives. A suppression emits nothing at all for its scope — and a threshold only keeps evidence if its key isolates each source.

The verdict is bought with the opening bytes and then the rest of the connection is switched, not inspected. An intruder opens benignly and moves everything that matters afterwards, inside one long-lived flow.

You stop guessing each host's reassembly and start paying in state, latency and blame. The device buffers every partial reassembly, becomes a failure point in the path, needs a signed-for behaviour when it is overwhelmed, and drops some traffic the destination would have accepted.

Byte matching ships this week, costs almost no state, and dies silently the day a byte changes. An analyzer gives durable session facts and answers to questions you never anticipated, but costs per-session state and permanent maintenance on a format the partner controls.

Client-to-client traffic inside the pool is home-to-home, so it never matches an external-to-home rule at all: a compromised laptop attacking a colleague over the tunnel is invisible. Widening both variables to any restores coverage and removes the cheap pre-filter, so payload evaluation runs on everything and the sensor starts dropping packets.

It licenses one claim: on traffic that actually crossed that sensor in that window, nothing benign matched. It says nothing about flows the window never contained - twice-yearly vendor maintenance, a rare failover - nor about firmware that changes next month.

Never all at once and never on a permanently fixed slot. Pilot on the least valuable branch to learn the real window, stagger the rest, put the most sensitive sites last, and cost the callout before you start.

Measure before deleting: find what each line currently swallows, rank by scope width against signature severity, remove the worst in staffed batches. Survivors need an owner, a reason and an expiry.

Decide the degradation order in advance rather than letting the box choose. Surrender depth on low-value bulk paths before breadth, never fall into blanket bypass unannounced, and alert on entering degraded mode — because an intruder can time a transfer to your predictable peaks.

Sensor count grows with nodes, not links, and interior traffic volume dwarfs the perimeter feed you sized against. What it consumes first is node CPU and the uplink you backhaul copies over — the same link you are trying to monitor.

The plaintext never existed anywhere on the network path, so no retention setting or budget recovers it. Give them what the copy does support - volume, direction, destination, timing - and point the payload question at the endpoint.

Express it as fabric coverage in a named time window, not as alert counts: at the busy hour we deliver only part of the mirrored traffic to the sensors, so a stated share of it is uninspected. Then convert random loss into chosen loss with a named owner and a review trigger.