This signature Sig 1307/0 will fire when the TCP window varies in a suspect manner. The right edge of the recieve window for TCP decreases. The TCP RFCs state that this should not occur.
This signature will NOT function in promiscuous mode.
Some incorrectly implemented proxies or network address translation firewalls could modify the window can cause this signature to fire.