Posted by Gnomad on Apr 06, 2016; 3:05am
URL: https://itus.accessinnov.com/Bridge-mode-bugfix-and-performance-improvement-tp561p659.html

Thanks for the tip.

For other readers, I've since spotted the snort FAQ on decoder and preprocessor rules here.  Note that although our decoder.rules are all configured as "alerts" by default - i.e., intended to log warnings only - some other setting (or a bug) must be upgrading them to drops.  Otherwise commenting them out/excluding them wouldn't have the affect on iTunes Store connectivity that it seems to.