That is very interesting, as I am able to confirm that it was not possible tune the “other engine” in version 1.2 of the IDSMC.
Perhaps someone can confirm this for me but I think that one thing to make especially sure of with this signature is that you do not have duplicate SYN requests with single Syn-Ack replies or even “no replies” in the data that you are sending to the monitor interface of the SPAN session as this could also lead to problems.
“Duplicate Traffic
In some configurations, SPAN sends multiple copies of the same source traffic to the destination port. For example, in a configuration with a bidirectional SPAN session (both ingress and egress) for two SPAN sources, called s1 and s2, to a SPAN destination port, called d1, if a packet enters the switch through s1 and is sent for egress from the switch to s2, ingress SPAN at s1 sends a copy of the packet to SPAN destination d1 and egress SPAN at s2 sends a copy of the packet to SPAN destination d1. If the packet was Layer 2 switched from s1 to s2, both SPAN packets would be the same. If the packet was Layer 3 switched from s1 to s2, the Layer-3 rewrite would alter the source and destination Layer 2 addresses, in which case the SPAN packets would be different.”
Reference: http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_guide_chapter09186a0080179597.html#1040560
