This overcomes the blindness that Snort has to get signatures split more than several TCP packets. Suricata waits right until the entire data in packets is assembled right before it moves the knowledge into Examination.Doesn’t Reduce Attacks: IDS detects and alerts but doesn’t quit attacks,