When does attack signature matching occur in the IPS packet processing flow on an SRX Series device?

A.
before fragmentation processing

B.
after protocol decoding

C.
before SSL decryption

D.
after IP actions

Explanation:
http://chimera.labs.oreilly.com/books/1234000001633/
ch13.html#ips_packet_processing_on_the_srx