The use of alert thresholding in an IDS can reduce the volume of repeated alerts,...

An attacker, working slowly enough, can evade detection by the IDS.

Network packets are dropped if the volume exceeds the threshold.

Thresholding interferes with the IDS’ ability to reassemble fragmented packets.

The IDS will not distinguish among packets originating from different sources.