ip and not src net 172.16 and dst net 172.16 and 
not (dst port 20 or dst port 80 or dst port 25 or dst port 113) and
tcp[13] & 3 != 0 
