alert icmp any any -> $HOME_NET any (msg:"ICMP connection test"; sid:1000001; rev:1;)