pass proto tcp all flags S/SA keep state scrub (reassemble tcp)