Are you suppressing the rule anywhere? Sometimes it might be wise to start from a clean sheet. The most persistent errors are the ones that you look over time and time again until you begin again, at which point they become obvious. See Also Snort Users Manual ...