even deeper packet inspection, searching for service changes