a) Event correlation is not possible.

b) It cannot detect broadcast packets.

c) It consumes resources on the host.

d) It can only perform signature-based detection.