strings *pcap | grep alice or use wireshark and pore through TCP