tcpflow: add head to formula