devguide: explain possible differences in data inspection with inline stream or not
The inline stream engine controls when and how data is inspected. In some cases, this may result in an asymmetry when traffic is inspected in inline mode or not (e.g. it would be possible to see [one] extra alert in inline mode when compared to non-inline mode).
When: ACKed or non-ACKed data.
How: by [ACKed] chunks?
This seems important to be documented, as in some cases - say, when running similar tests in IDS vs IPS mode, there could be a mismatch in the number of alerts generated, due to that.
No data to display