TMS zl Management and Configuration Guide ST.1.1.100430

6-14
Intrusion Detection and Prevention
Threat Detection and Prevention
Figure 6-2. IDS Packet Flow in Monitor Mode
A packet that is mirrored to the TMS zl Module in monitor mode is examined
by the IDS. If the IDS detects a threat, it creates a log entry. IDS sessions are
based on several factors:
■ Protocol
■ Source zone
■ Source IP
■ Source port
■ Destination zone
■ Destination IP
■ Destination port
However, the IDS depends on sessions, and if the sessions run out, the IDS
will drop packets. The TMS zl Module’s IDS can support approximately
600,000 connections.