show error when the default class is defined as group, changed match tcp-syn and match tcp-acks to be separate options from tcp and applied to commands only when tcp is also specified