Once the protocol decoders separate the network traffic by protocol, the IPS engine examines the network traffic for the attack signatures.