If you capture beginning to end, look inside packet #1 :)