ip and not (src net 172.16 and dst net 172.16) and dst port 23 and 
tcp[13] & 3 != 0 
