i am using MARS, and using IME (ips manager express) to monitor the network. i found that the alerts reporting from MARS are almost totally different from what the IME reporting. I thought they are using the same signature?? for example, IME reports an high alert on "tcp hijack"; but MARS is not repoting this...so do other many signatures. I thought they at least reporting similar events...am i missing anything here?