Reverse engineering from a wireshark pcap