Thanks for the help. I have read the link you provided. I am looking for a far more granular document. Basically, I'm looking for a tcpdump breakdown of each packet, and which parts of the packet payload mean what. I have been able to figure out most of the conversation, but there blanks left that need filling. Thanks again for any help.