(http.request or ssl.handshake.type == 1) and !(ssdp)