Currently the flow is created taking only the timestamp into consideration. Using the current logic (looking up the first request based on timestamp), could throw some unintended errors, but if we were to consider tcp flags, it could produce more fruitful results.