I was pretty impressed that the blog post author thought of this. Pretty classic Eureka moment! I wonder if there's a way for regular people to do this with something like Packetbeat and tcpdump?