I understand what they are supposed to be, but how did Mike get his hands on them? And how does he know what he has are legit?
To go along with that, does he have anyway of proving these are legit captures? or is that what this is supposed to prove?
It can be external or internal. To know what you are looking for the packet normally has a header. I remember back in the day sniffing yahoo messenger and chat. Just to get the protocol so you could replicate the packet for your own program to make booters or bots.