title: Snort rule to detect a three-way handshake
body: <p>I have been trying to write a rule to detect the establishment of a connection "Three way handshake" using snort IDS: </p>
  
  <p>alert tcp 10.10.10.10 any -> any any (sid:1000; flags:S; msg:"SYN detect";)</p>
  
  <p>Every time i run the snort with this rule it doesn't detect the connection? is there any syntax error !! or should modify anything! </p>
  
  <p>appreciate the help</p>