how does the IPS engine inspect the traffic?

In terms of application and protocol recognition, how does the IPS engine inspect the traffic?

A.
unidirectional on the incoming interface

B.
unidirectional on the outbound interface

C.
only traffic from and to well-known ports

D.
bidirectionally