title: how to know if snort detects syn flood attacks since snort alert is not logging any thing
body: <p> I have snort running on Centos as IDS.  I am trying to test if snort can detect the syn flood attack. I am sending the attack from the same LAN network. I added this rule in local.rules <code>alert tcp !$HOME_NET any -&gt; $HOME_NET 80 (flags: S; msg:&quot;Possible TCP DoS&quot;; flow: stateless; threshold: type both, track by_src, count 70, seconds 10; sid:10001;rev:1;)</code>. Snort alert file is not logging when I run snort in fast  mode. It  was logging but now it is not . So I cannot see if it detects the attack or not . How can I make snort detects this attack ?</p>