Summary

This section highlights the key topics discussed in this chapter:

• A virtual sensor is a collection of signature, event action, and anomaly detection parameters.

• The traffic normalizer provides evasion protection when inline.

• Configure reassembly settings and use strict TCP reassembly when using promiscuous mode.

• The sensor TCP session tracking mode can be configured to adapt to specific environments.

• Bypass mode is used to avoid traffic disruptions, but there are security risks and limitations.