(tcp and (tcp[13] & 2 != 0) and
((dst port 143) or
(dst port 111) or
(tcp[13] & 3 != 0 and tcp[13] & 0x10 = 0 and dst net 172.16 and dst port 1080) 
or
(src port 31337) or
(src port 0 or dst port 0) or
(dst port 8181) or
(tcp[2:2] < 20) or
(dst port 512 or dst port 513 or dst port 514) or
((ip[19] = 0xff) and not (net 172.16/16 or net 192.168/16)) or
((ip[19] = 0x00) and not (net 172.16/16 or net 192.168/16)) or
(ip[12:4] = ip[16:4]))) 
