まず「何を条件に指定できるのか」と言うのが根本にあるのですよね。IPパケットのレベルで考えるのなら「IPヘッダ」ですし、TCP/UDPの場合は「TCP/UDPヘッダ」です。その中に何が情報としてあるのか、と言うのがわかっていればそんなに悩むことはありません。
（まぁ基本として「送信元」「宛先」アドレスが条件に含まれるのでここでは触れません）

IPプロトコルの場合は

Router(config)#access-list 100 deny ip any any ?
  dscp        Match packets with given dscp value
  fragments   Check non-initial fragments
  log         Log matches against this entry
  log-input   Log matches against this entry, including input interface
  option      Match packets with given IP Options value
  precedence  Match packets with given precedence value
  time-range  Specify a time-range
  tos         Match packets with given TOS value
  ttl         Match packets with given TTL value
  <cr>

とありますが、これは https://ja.wikipedia.org/wiki/IPv4#%E3%83%91%E3%82%B1%E3%83%83%E3%83%88 にあるようにIPヘッダに含まれている情報にフィルタ条件が指定できることがわかります。

他も同じことですね。上位層プロトコルというかTCP/UDP/ICMPヘッダにある情報がなんでも指定できると言うだけです。

Router(config)#access-list 100 deny tcp any any ?
  ack          Match on the ACK bit
  dscp         Match packets with given dscp value
  eq           Match only packets on a given port number
  established  Match established connections
  fin          Match on the FIN bit
  fragments    Check non-initial fragments
  gt           Match only packets with a greater port number
  log          Log matches against this entry
  log-input    Log matches against this entry, including input interface
  lt           Match only packets with a lower port number
  neq          Match only packets not on a given port number
  option       Match packets with given IP Options value
  precedence   Match packets with given precedence value
  psh          Match on the PSH bit
  range        Match only packets in the range of port numbers
  rst          Match on the RST bit
  syn          Match on the SYN bit
  time-range   Specify a time-range
  tos          Match packets with given TOS value
  ttl          Match packets with given TTL value
  urg          Match on the URG bit
  <cr>

Router(config)#access-list 100 deny udp any any ?
  dscp        Match packets with given dscp value
  eq          Match only packets on a given port number
  fragments   Check non-initial fragments
  gt          Match only packets with a greater port number
  log         Log matches against this entry
  log-input   Log matches against this entry, including input interface
  lt          Match only packets with a lower port number
  neq         Match only packets not on a given port number
  option      Match packets with given IP Options value
  precedence  Match packets with given precedence value
  range       Match only packets in the range of port numbers
  time-range  Specify a time-range
  tos         Match packets with given TOS value
  ttl         Match packets with given TTL value
  <cr>

Router(config)#access-list 100 deny icmp any any ?
  <0-255>                      ICMP message type
  administratively-prohibited  Administratively prohibited
  alternate-address            Alternate address
  conversion-error             Datagram conversion
  dod-host-prohibited          Host prohibited
  dod-net-prohibited           Net prohibited
  dscp                         Match packets with given dscp value
  echo                         Echo (ping)
  echo-reply                   Echo reply
  fragments                    Check non-initial fragments
  general-parameter-problem    Parameter problem
  host-isolated                Host isolated
  host-precedence-unreachable  Host unreachable for precedence
  host-redirect                Host redirect
  host-tos-redirect            Host redirect for TOS
  host-tos-unreachable         Host unreachable for TOS
  host-unknown                 Host unknown
  host-unreachable             Host unreachable
  information-reply            Information replies
  information-request          Information requests
  log                          Log matches against this entry
  log-input                    Log matches against this entry, including input
                               interface
  mask-reply                   Mask replies
  mask-request                 Mask requests
  mobile-redirect              Mobile host redirect
  net-redirect                 Network redirect
  net-tos-redirect             Net redirect for TOS
  net-tos-unreachable          Network unreachable for TOS
  net-unreachable              Net unreachable
  network-unknown              Network unknown
  no-room-for-option           Parameter required but no room
  option                       Match packets with given IP Options value
  option-missing               Parameter required but not present
  packet-too-big               Fragmentation needed and DF set
  parameter-problem            All parameter problems
  port-unreachable             Port unreachable
  precedence                   Match packets with given precedence value
  precedence-unreachable       Precedence cutoff
  protocol-unreachable         Protocol unreachable
  reassembly-timeout           Reassembly timeout
  redirect                     All redirects
  router-advertisement         Router discovery advertisements
  router-solicitation          Router discovery solicitations
  source-quench                Source quenches
  source-route-failed          Source route failed
  time-exceeded                All time exceededs
  time-range                   Specify a time-range
  timestamp-reply              Timestamp replies
  timestamp-request            Timestamp requests
  tos                          Match packets with given TOS value
  traceroute                   Traceroute
  ttl                          Match packets with given TTL value
  ttl-exceeded                 TTL exceeded
  unreachable                  All unreachables
  <cr>

そして、OSI 7階層モデルで考えると「他のレイヤの情報は見えない」のですから、IP（レイヤ３）のレベルではTCP/UDP（レイヤ４）の情報を識別できない＝ACLの条件として利用できない（eq sshのような指定はできない）と言うだけのことです。