Where a connection sent to inspection goes, measured - and then the inspector made, 2026-10-23
A connection on the coprocessor has a third verdict beside forward and drop: send to inspection (0). The fast path then hands the connection's frames to an inspector instead of the wire, and the inspector hands each one back to be sent on - the shape an IPS needs to see a connection's start and let the rest run in hardware (the discovery, 680). Before building anything on it, this is where those frames go on an appliance running OPNsense.
The whole page, with how it was taken and what it does not show: Where a connection sent to inspection goes, measured - and then the inspector made, 2026-10-23.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.