Format

    flow:[(established|not_established|stateless)] 
        [,(to_client|to_server|from_client|from_server)]
        [,(no_stream|only_stream)]
        [,(no_frag|only_frag)];