An intrusion prevention system (IPS) like Snort can operate in either inline or flexible response mode. Flexible response mode replicates all inbound traffic to a "mirror port" using a network switch. The IPS analyzes this mirrored traffic and sends RST packets to terminate any connections that match drop rules, allowing it to respond proportionately to threats without blocking the network flow. While inline mode can block attacks faster, flexible response is preferable when latency is too high or the IPS is passive, making its efficiency dependent on CPU and memory resources.