first packet sniff works