Which three criteria determine if a packet entering an SRX Series device belongs to an existing session?