The LoadMaster IPS system operates by comparing the URL requested with a list of known attack vectors. This requires predominantly CPU utilization. Of course the SNORT rule set must also be loaded into RAM beforehand, so there is an amount of RAM that will also be utilized.