You may want to add for something like tcp.time_relative < 2. This will scoop up streams that see a RST very shortly after the connection is established and weed out false positives from actual data transferring streams that happen to end with a RST.