5.x sensor, as viewed from the event monitoring directly on the sensor.sig 3030 events do not seem to include the actual destination port. This seems rather strange given the description of the signature. Is this normal? Am I misunderstanding the NS...