This article documents the function of the "set security idp sensor-configuration flow drop-on-limit" command. 

In the 12.1X44-D20+ Junos code, there is a new command, "set security idp sensor-configuration flow drop-on-limit." What does this command do?

In the case when the SRX IDP hits a resource limit (e.g. memory allocation fails), the default behavior is to ignore the flow and let the flow pass without inspection. This is the documented default behavior since most customers do not enforce traffic dropping due to IDP limits.

The new knob (drop-on-limit) changes this behavior by dropping such flows. We suggest this knob to customers who require all traffic to be inspected by IDP or no traffic to be allowed without inspection. This knob ensures IDP attack inspection.