mark as 1 if tcp and dport is 22
