A data center team reports that intrusion alerts fire when an HTTP request fits in one TCP segment but go quiet when the request is split across several segments, while alerts for single-packet UDP traffic under the same policy keep firing. Packet captures confirm the split requests arrive intact on the monitored interface. Which network analysis policy component should the team verify first?
Select an answer to reveal the explanation.
Short Explanation
When you see alerts go quiet for split TCP requests, check that TCP stream reassembly is enabled in the policy assigned to that traffic. Without it, a rule may miss content spread across segments—like puzzle pieces that never get put together.
Full Explanation
Network analysis policies hold preprocessors and inspectors that decode and normalize traffic before detection. TCP stream reassembly reconstructs TCP streams for inspection, so verify that it is enabled and that the applicable network analysis policy is assigned to the traffic. Without effective reassembly, a rule that needs content spanning segments may not match; a request contained in one segment does not require segments to be joined. Tuning the HTTP inspector does not perform TCP stream reassembly. Migrating to Snort 3 is not a substitute for configuring the applicable policy. IP fragment reassembly addresses IP fragmentation, not TCP segmentation. As a practical check, review the policy assignment and its stream reassembly configuration while replaying the split request.