An engineering firm runs a legacy order service that produces large fragmented IPv4 traffic across its data center segment. Intrusion events never appear for this service even though an intrusion policy is attached to the rule, and packet captures show fragments arriving but no reassembled datagrams handed to the inspection engine. Which network analysis policy adjustment should be made?

The correct adjustment is to apply a network analysis policy with IPv4 fragment reassembly enabled before intrusion inspection. The network analysis policy performs preprocessing, and the intrusion engine needs the reconstructed IPv4 datagram to inspect fragmented traffic as a complete unit; without reassembly, fragments may arrive without any datagram being handed to the engine, so an attached intrusion policy alone cannot produce detections. Raising intrusion sensitivity or enabling more rules changes signature coverage, not packet reconstruction, and individual fragments may not contain enough information to match a signature. TCP stream reassembly addresses a different layer: it orders and rebuilds TCP segments, but it does not replace IPv4 fragment reassembly. Adding an access control rule to log the flow or schedule a packet capture can record or copy traffic, but neither action reconstructs IPv4 datagrams for intrusion inspection. Exam caveat: distinguish IPv4 fragmentation from out-of-order TCP segmentation; they require different reassembly functions, even though both involve packets arriving in pieces. Practical check: verify that the applicable network analysis policy has IPv4 fragment reassembly enabled and is actually applied to the traffic being inspected.