updated Wireshark analysis