Snort's Flow Control options
 

Whats the difference between the flow control options (like to/from_server and to/from_client) and the arrow in the rule header that specifies the direction. Also what is the difference between these flow control options:

to_server and from_client
from_server and to_client
only_stream and established
no_stream and stateless

This all seems pretty redundant to me.

Whats the difference between the flow control options (...) and the arrow in the rule
Flow control is used where separate packets are stitched together to form a stream, flow. That way Snort can examine more. The "Writing Snort rules" HOWTO on Snort.org has the gory details (2.3.35 Flow).

Thanks... thats pretty cool you can make it stateful on a per rule basis. :cool: