False positive alerts - rules fire on unmatching payload

["Humes, David G." <David.Humes () jhuapl edu>]

I just turned on the new spyware-put rules.  Since most of those rules
are looking at User-Agent strings, I would expect a fairly low false
positive rate.  In most cases when I look at the payload, I see what
made the rule fire, like FunWebProducts or similar.  But, many times
neither FunWebProducts or User-Agent is even present in the payload.
I'm referring to sid 5856 now, but it really doesn't matter.  The
general problem is that Snort sometimes alerts when the data does not
match the rule that fired.  Usually, I can confirm that there was
traffic between the two hosts reported in the alert and at the time of
the alert.  But, the payload just doesn't match at all.  I've been
working with Snort for over two years now and have seen this problem
through each version that I've installed, and keep hoping that it will
be better in the next release.  Our current sensor is running
comfortably with the snort process taking up about 30% of the CPU and
4.5% of the memory.  The drop is usually less than 0.5%.  So, I don't
think there's a loading problem.  And even if there was, I can't see how
it would explain this problem.  Any thoughts?

--Dave