What signature do you expect to alert and do you have a pcap example that you would expect to trigger the alert?