how did Mike get his hands on them?

When your computer is on a home network, the packets are broadcast to everyone on the network. And each computer only looks for their ip address to see if the packets are intended for them.

However all computers on the network are getting the packets. So you only need a computer connected to a network to start logging and recording all of the data being sent on the network.

It looks like the voting machines were being connected to the internet, and using wifi. So any of the staff who knew about the wifi network and the wifi password could connect to the access point, and capture all of the packets being broadcast on the network.

And how does he know what he has are legit?

Probably because he has multiple people assisting in the packet capture. The staff at each one of the polling sites should be capturing packets from wifi on the client-side. And he might have whistle blowers from dominion capturing packets on the server side.

So the packets from the client-side and server-side should match up and validate each other. That should give you enough confirmed data-points that you know are correct, to validate the rest of the data.

Also if the packets are in real-time, it would be very hard to write a spoof program to inject realistic fake data into the packet capture to try and pretend like something else is happening.

To go along with that, does he have anyway of proving these are legit captures?

When information is sent over the network, it doesn't go straight from point a to point b. It get sent over a network, where the data bounces between different computers in different data centers before finally getting to the server.

For instance, even opening up google.com will probably be forwarded through 10 different computers before arriving at google. And all of this information is logged. The problem is that this raw log of information is pretty worthless, because there's so much data you wouldn't know what to look for.

But if you have the packet captures from the client and the server. You know which ip addresses, and what time they sent the information. And this should be stored in the logs of all of the different data centers that the packets pass through. And if they check their logs, they should be able to validate that, "yes, this traffic did pass through here". And it's likely that the Space Force, or NSA has access to these logs.

or is that what this is supposed to prove?

What it basically proves is foreign interference. You have a log of all of these different points all the way through election night of these voting machines that are connected to the internet.

So you'll likely have a record of all of the vote tallies as they are happening through the night. So the voting machines send packets to the dominion server for the current vote of { trump : 200k, biden 50k }, and then you have packets going to and from a foreign server that say { trump : -50k, biden : + 50k }.

And then in the next dominion server check you see { trump: 150k, biden :100k }. The information can be tracked to see when and how votes are being changed, depending on the totals they are reporting back. And when those change based on when the voting machine connected to a foreign server.