[Bro] detect Ack flooding attack

[Vern Paxson]

> ./bro -f "(tcp and ((tcp[13] & 0x7 != 0) or (tcp[13] & 0x10 == 1)) ) or udp or

The second test you give, for capturing ACK packets, is incorrect.
It needs to be

	(tcp[13] & 0x10 == 0x10)

- Vern