Read all about it, one packet is all is takes (if you run snort in verbose mode)..

http://isc.sans.org/diary.php?date=2005-09-13