updates based on wireshark testing