tcpdump “tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)«2)) - ((tcp[12]&0xf0)»2)) != 0)”

easier command:

tcpdump -i eth0 not port 22