IDS: SHADOW anomaly

[Brian Hughes <hughbria@isu.edu>]

FAQ: See http://www.ticm.com/kb/faq/idsfaq.html
IDS: See http://www-rnks.informatik.tu-cottbus.de/~sobirey/ids.html
HELP: Having problems.. Then email questions to ids-owner@uow.edu.au
NOTE: You MUST remove this line from reply messages as it will be filtered.
SPAM: DO NOT send unsolicted mail to this list.
USUB: email "unsubscribe ids" to majordomo@uow.edu.au
---------------------------------------------------------------------------

Hello Everyone,

If this is not the correct place for this post please point me in the
right direction.  I sent email to sans@clark.net, but only received an
automated response.

I'm currently deploying SHADOW and am seeing some strange behavior. 
I've created a bad_events filter which produces one set of results when
run manually using tcpdump and yields another set of results when shadow
uses it to display its Web page.  I was wondering if anyone else had
encountered this problem or better yet solved this problem :-).

Best Regards,
Brian
-- 
Brian Hughes               mailto:hughbria@isu.edu
Idaho State University     http://www.isu.edu/~hughbria