which step?

In the sequence of IPS inspection steps, protocol anomaly detection is performed after which step?

A.
after fragments are reassembled

B.
after packets in sessions are tracked

C.
after applications and decode protocols are identified

D.
after packet signatures are checked