3340/0 false positives

[mhellman]

This signature triggers on =shell: anywhere in the tcp stream.

Isn't there a way to tighten this up? If fires even when I got to the Cisco MySDN page for this signature (because it has the word =shell: in the html returned).

[jlimbo]

Hi,

Thanks for bringing this to our attention, we will have a closer look at this signature to see where it can be improved.

Is it the mainpage of MySDN that causes the FP? If it is something more specific, would you be able to provide the URL please?

Thanks,

Jonathan

[mhellman]

I believe it triggered on this URL:

http://tools.cisco.com/MySDN/Intelligence/viewSignature.x?signatureId=3340&signatureSubId=0