Bypass IPS with streamed attacks?

[snobs]

Hello,

yesterday I listened to a presenation and live demo, where a consultant bypassed IPS systems by running an attack kind of slowly in a lengthy stream on a well known attack and executed "calc" on Windows Server (Well, at the end only one vendor was able to block that attack, i.e. Forcpoint...)

This brings me to the question, how Fortigate firewalls actually do IPS scanning. Will they pass the data to a destination while scanning the traffic and cut the connection if they found anything, or will it do something else? (I´ll try to get the slides from the presenation so I can give better information)

Regards