IDS/IPS

You must re-aggregate the two directions and keep them together all the way to one engine instance: enough aggregation capacity for both directions at peak, and flow-aware or symmetric load balancing so a session's two halves land on the same receive queue and worker.

Wherever the map now names the wrong stack, the sensor resolves overlapping data the way the old occupant did, so an attacker who fingerprints the real host wins there. Re-deriving means rebuilding an OS inventory for an estate you inherited and do not control.

Essentially nothing above the transport. Analyzers attach from a stream's opening bytes, so a session already in progress yields no protocol identification, no file records and no hashes - only a partial connection record until it ends.

Silence proves nothing, so make the box prove itself: poll its bypass and engine state, compare the bytes it claims to have inspected against the router's flow records for that link, and schedule a benign test a known rule must catch.

A threshold is a number relative to a baseline, and campus segments differ by orders of magnitude. One value high enough to survive the noisiest segment sets a bar an intruder simply stays under.

Publish the evasion margin: the variants tested and matched, the variants known not to match, and the conditions - buffer, direction, ports - under which the rule holds. Refuse the binary 'detected', because someone will stop funding the gap on the strength of it.

Everything needed to compare two outages in one set of units: the exposure if the intruder is not blocked, the worst credible wrong drop and its cost per minute, the exact rules enforced, and who can revoke it how fast.

Full inspection and a latency figure at the contracted throughput cannot both hold at peak. Write the configured limits into the service description in plain words, price the alternative, and have the tenant's risk owner accept or fund the gap in writing.

Choose by what a compromise there would cost and by whether any other record would exist, not by traffic volume. Then publish a dated per-segment list stating what is sensed, at what depth, and where no record would exist at all — and have the risk owner accept it, not the security team.

Only when you must know what was inside the traffic and the endpoint cannot tell you. Terminating spends a copy that can never break production, and buys plaintext custody, an in-path failure domain, and clients that fail rather than be read.