Indeed, but the tcp struct field `cinfo.dst_port` is only set in such cases, otherwise, for normal tcp, is 0.
I let this PR in background for a while to think if other option would be better, but ultimately adding more conditions would add complexity without benefits, because for normal TCP connections `cinfo.dst_port` is 0 and the `(l_port == 0)` was already there and it will match before comparing ` (l_port == a->parent->cinfo.dst_port)`.
``` && ((l_port == 0) || (l_port == a->parent->rcv.dst_port) || (l_port == a->parent->cinfo.dst_port)) ```