record timestamp
parse cookie from packet