EC-Council Certified Ethical Hacker (CEH) v13 (312-50v13) Practice Exam 2026 – Your All-in-One Guide to Certification Success!

During session splicing, a transmitter tries to break a single session into pieces to defeat how an IDS reconstructs traffic. Stateful IDS monitor per-session state and hold reassembly buffers for a window of time. If a packet for that session doesn’t arrive within a reasonable period, the IDS will time out and discard the partial reassembly, stopping any further attempt to reassemble that stream. This prevents resources from being tied up on an incomplete session and means the IDS will not reassemble or inspect that portion of traffic.

That’s why the best description is that many IDS stop reassembling and handling that communication stream. The other options don’t fit because timing out doesn’t cause a protocol switch, immediate attacker logging isn’t guaranteed by this behavior, and the IDS isn’t forced to continue reassembling regardless of timing.