ip and dst port 22 and tcp[13] & 3 != 0 
