From 1a724ba851b8c63c2d66232046b68da47a8de6fa Mon Sep 17 00:00:00 2001
From: Jason Ish <ish@unx.ca>
Date: Thu, 13 Oct 2016 13:53:27 -0600
Subject: [PATCH] doc: flow: update and add new keywords

---
 doc/userguide/rules/flow-keywords.rst | 73 +++++++++++++++------------
 1 file changed, 42 insertions(+), 31 deletions(-)

diff --git a/doc/userguide/rules/flow-keywords.rst b/doc/userguide/rules/flow-keywords.rst
index 75824db03c..f9f354539b 100644
--- a/doc/userguide/rules/flow-keywords.rst
+++ b/doc/userguide/rules/flow-keywords.rst
@@ -59,37 +59,48 @@ only (only_stream) or on packet only (no_stream).
 
 So with the flow keyword you can match on:
 
-::
-
-  to_client                       established           only_stream
-  from_client                     stateless             no_stream
-  to_server
-  from_server
-
-**NOTE:** *from_server* and *to_client* are the same, and so are
- *to_server* and _from_client_. This comes from the original Snort
- language and we support it for compatibility reasons.
-
-These options can be combined. You can use
-up to three options. For example:
-
-::
-
-  flow:to_client, established;
-  flow:from_client, established, only_stream;
-
-There are different ways in which can be checked whether the
-connection is established or not. With tcp-traffic a connection starts
-with the three-way-handshake. In the flow is a part in which the state
-is set. There will be checked in which state the connection is.  In
-other cases there will be just checked if traffic comes from two
-sides.
-
-Example:
-
-.. image:: flow-keywords/Flow1.png
-
-.. image:: flow-keywords/Flow2.png
+to_client
+  Match on packets from server to client.
+to_server
+  Match on packets from client to server.
+from_client
+  Match on packets from client to server (same as to_server).
+from_server
+  Match on packets from server to client (same as to_client).
+established
+  Match on established connections.
+not_established
+  Match on packets that are not part of an established connection.
+stateless
+  Match on packets that are and are not part of an established connection.
+only_stream
+  Match on packets that have been reassembled by the stream engine.
+no_stream
+  Match on packets that have not been reassembled by the stream
+  engine. Will not match packets that have been reeassembled.
+only_frag
+  Match packets that have been reassembled from fragments.
+no_frag
+  Match packets that have not been reassembled from fragments.
+
+Multiple flow options can be combined, for example::
+
+  flow:to_client, established
+  flow:to_server, established, only_stream
+  flow:to_server, not_established, no_frag
+
+The determination of *established* depends on the protocol:
+
+* For TCP a connection will be established after a three way
+  handshake.
+
+  .. image:: flow-keywords/Flow1.png
+
+* For other protocols (for example UDP), the connection will be
+  considered established after seeing traffic from both sides of the
+  connection.
+
+  .. image:: flow-keywords/Flow2.png
 
 Flowint
 ~~~~~~~