doc: flow: update and add new keywords

doc/userguide/rules/flow-keywords.rst

@@ -59,37 +59,48 @@ only (only_stream) or on packet only (no_stream).
 
 So with the flow keyword you can match on:
 
-::
+to_client
-
+  Match on packets from server to client.
-  to_client                       established           only_stream
+to_server
-  from_client                     stateless             no_stream
+  Match on packets from client to server.
-  to_server
+from_client
-  from_server
+  Match on packets from client to server (same as to_server).
-
+from_server
-**NOTE:** *from_server* and *to_client* are the same, and so are
+  Match on packets from server to client (same as to_client).
- *to_server* and _from_client_. This comes from the original Snort
+established
- language and we support it for compatibility reasons.
+  Match on established connections.
-
+not_established
-These options can be combined. You can use
+  Match on packets that are not part of an established connection.
-up to three options. For example:
+stateless
-
+  Match on packets that are and are not part of an established connection.
-::
+only_stream
-
+  Match on packets that have been reassembled by the stream engine.
-  flow:to_client, established;
+no_stream
-  flow:from_client, established, only_stream;
+  Match on packets that have not been reassembled by the stream
-
+  engine. Will not match packets that have been reeassembled.
-There are different ways in which can be checked whether the
+only_frag
-connection is established or not. With tcp-traffic a connection starts
+  Match packets that have been reassembled from fragments.
-with the three-way-handshake. In the flow is a part in which the state
+no_frag
-is set. There will be checked in which state the connection is.  In
+  Match packets that have not been reassembled from fragments.
-other cases there will be just checked if traffic comes from two
+
-sides.
+Multiple flow options can be combined, for example::
-
+
-Example:
+  flow:to_client, established
-
+  flow:to_server, established, only_stream
-.. image:: flow-keywords/Flow1.png
+  flow:to_server, not_established, no_frag
-
+
-.. image:: flow-keywords/Flow2.png
+The determination of *established* depends on the protocol:
+
+* For TCP a connection will be established after a three way
+  handshake.
+
+  .. image:: flow-keywords/Flow1.png
+
+* For other protocols (for example UDP), the connection will be
+  considered established after seeing traffic from both sides of the
+  connection.
+
+  .. image:: flow-keywords/Flow2.png
 
 Flowint
 ~~~~~~~