firewall3: clean up the flow table detection logic