title: Snort Rule to Alert DNS that has ACK
body: <p>What way can i write a rule to alert me of a DNS that has an ACK when it shouldnt? Im quite confused on this.</p>
  
  <p>This is what i see in wireshark <code>Acknowledgment Number: 0x000001a4 [should be 0x00000000 because ACK flag is not set]</code></p>
  
  <p>But i want a rule that will alert me.</p>
  
  <p>This rule below isnt working for me.</p>
  
  <p><code>alert tcp any any -&gt; 192.168.10.2 53 (msg:"MALFORMED DNS QUERY"; flags: A; ack:0; sid:10501;)</code>
  The above wont show in my alert log. But if i remove flags: and ack: it will.</p>