Embed Notice

DISCLAIMER: I am not a network professional and there's more Wireshark stuff I could have done this is just for approachability.

Okay, we've found a boundary layer. This is the last SSH-tagged packet and the last from the remote server, plus an ACK from client. After that it's internal noise. (you could filter more but don't have to).