Try to check nmap scan with suricata

Hello,
I’m trying to detect every nmap scan with suricata, at this moment I can detect nmap then is used with options -A or -T4.
I don’t see any log updating when nmap is used with options nmap -sS or nmap -p-

For example I have these rules:
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:“ET SCAN NMAP -sS window 4096”; fragbits:!D; dsize:0; flags:S,12; ack:0; window:4096; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2009584; classtype:attempted-recon; sid:2009584; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

or

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:“ET SCAN NMAP -sS window 3072”; fragbits:!D; dsize:0; flags:S,12; ack:0; window:3072; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2009583; classtype:attempted-recon; sid:2009583; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

or

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:“ET SCAN NMAP -sS window 1024”; fragbits:!D; dsize:0; flags:S,12; ack:0; window:1024; threshold: type both, track by_dst, count 1, seconds 60; reference:url,doc.emergingthreats.net/2009582; classtype:attempted-recon; sid:2009582; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Why suricata doesn’t update the log if I use nmap -sS … to the suricata server?
Thanks.
Regards.
Luke

What version are you running?
How did you configure Suricata?
How are the HOME_NET variables set and do you have example pcaps?

I would guess it’s just a configuration issue.

I am facing the same issue