Anyone else having signature 5120 triggered from traffic going out of their network to IP 129.33.31.73(IBM ALMADEN Research)? I have multiple clients getting this event heading for the same destination. None of them are running Netscape servers.
If you have packet traces for these false positives we'd be happy to look at them and get them corrected. Just send the pcap to anthall@cisco.com and we'll look at it.
