An interface group, also known as port clustering in networking parlance, combines the traffic processed on separate Sensor interfaces—or, in the case of a HA pair, on separate Sensors—into a single logical interface for state and intrusion analysis. Asymmetric routing is a good example of where an interface group is recommended. In asymmetric routing, a TCP connection does not always send and receive along the same network path. Therefore, a single-interface Sensor monitoring this transmission may only see the traffic received, not the traffic sent in response; thus not seeing all data from a transmission.
Sensors' multiple interfaces make the monitoring of asymmetric traffic possible. For example, as shown in the following figure, an M-4050 has four ports that are wired in pairs by default, and therefore two interfaces. Peer ports 1A and 1B can monitor one direction of an asymmetric transmission, while peer ports 2A and 2B can monitor the other direction. By making an interface group of 1A-1B and 2A-2B, the Sensor is able to see all the traffic for all sessions in the asymmetrically routed network and still is able to maintain state and accurately detect all attacks.
.png)