How can I identify what data was exfiltrated from a pcap file?