protocol reverse engineering: samples captured