In a stream of hex data for each packet, I want to identify whether protocol is syslog protocol or not, so what value should I compare?