I made only a half batch incase i didn't like it. I followed the recipe exactly and wouldn't change anything BUT let me warn you, you will need to filter when pouring into a glass to drink, and it blocked my filter making this a little difficult due to the pumpkin puree. I do not strain any kombucha but it was needed to drink this properly.
I let them go for 1-2 weeks before refrigeration which seems to be longer than most people, but i like strong carbonation so i aim to over do it vs under do it.
Im a little knowledgeable with this stuff but i do not know how to see the "handshake" itself, but maybe this is synonymous with what i am doing:
Right click any of the packets (TCP or SSH) > Follow > TCP stream
From there i can see some info about the ssh protocol and connection, as well as the 2 devices communicating (Operating systems used) followed by random gibberish which is the encrypted data.
When I analyze the TCP packet "frames", they contain data including the motherboard manufacturer, but packets themselves look like its just gibberish.
It looks like everything is in 1 stream, maybe that answers your question? I am capturing traffic only on port 22 briefly while the rsync is running to look at the packets
Good job