Might be worth a look with wireshark