Chapter 8

The three reassembly modes include the following:

• __________________ There can be gaps in the sequence space and the session is still analyzed while many anti-evasion checks are disabled.

• __________________ The default setting and recommended by Cisco best practices. The sensor must see all packets of a session to reassemble.

• __________________ Traffic is only in one direction and is enough to analyze, but most anti-evasion checks are disabled.