Short summary of IPS architecture;
PSL (passive streaming layer) > Verify tcp retransmission, reassemble packets into a protcol segment, prevent tcp spoofing
USL (Unified Streaming Library) > This is the connector between PSL and protocol parsers. USL will decide which protocol parser will be used to retrieve information from packet.
SPII (Stateful Protocol Inspection Infrastructure ) > This will verify that the packet is RFC compliant and headers correspond to expected state.
CMI (Context Management ) > Recieves contexts from parsers, decides and runs active protections on relevant contexts, decides the final action to be performed on the packet. Core of the IPS
PM (Pattern Matcher) > Enables protections to be more accurate. Decreases the development time of new protections.
Works in two tiers to improve performance.
ASPII (Accelerated Stateful Protocol Infrastructure ) > This manages which protection will run on which connection.
Performance > IPS blade will definitely increase the load on gateway but depends on your protections in profile and vary traffic characteristic. Perhaps check mates may give the percentage of the IPS blade activation impact.
There is a script collects (get_ips_statistics.sh) and analyse data for showing which matched IPS protections cause a high load on the CPU. sk43733
Debug > fw ctl zdebug + aspii spii cmi machine | for knowing which protections actually run on a certain conn.
#ips debug -e <filter > -o <output file>
-m fw + vm drop spii cmi aspii advp ips