Pass rule not working

["Tony Wong" <tony.wong () stanford edu>]

I have the following pass rules in 

Shellcode.rules

pass tcp mysubnet/21 any -> mysubnet/21 $SHELLCODE_PORTS (msg:"SHELLCODE
x86 setuid 0"; content: "|b017 cd80|"; reference:arachnids,436;
classtype:system-call-det......

pass tcp mysubnet/21 any -> mysubnet/21 $SHELLCODE_PORTS (msg:"SHELLCODE
x86 NOOP"; content: "|90 90 90 90 90 90 90 90 90 90 90 90 90 90|";
depth: 128; reference:$..........

pass tcp 171.64.184.0/21 any -> mysubnet/21 $SHELLCODE_PORTS
(msg:"SHELLCODE x86 NOOP"; content: "|61 61 61 61 61 61 61 61 61 61 61
61 61 61 61 61 61 61 61 61 61|"; c$............


But I am still getting these SHELLCODE x86 alerts in ACID.

Any ideas?



-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users