Close to a solution, moving for wireshark. Address swapping weirdness.