I did a search and only found 4 topics, but they were quite outdated (3+ years). Anyways, I was wondering if anybody recently has done any packet sniffing to figure out exactly what information is sent to Microsoft. It could shed some light on these banning theories and help the modders out.

Also, if the information is sent in plain-text, it is possible to change your key sent to Microsoft on-the-fly. That means that it may be possible to become unbanned by spoofing your traffic and making MS think you're playing on an unbanned console. That's probably not the case since I would hope MS encrypts my XBL username/password, but still a chance. However, this method is no better than the recent discovery as it will need a valid key, but it may be worth looking into.

I'm going to start my own tests to see what is transmitted and it would be helpful if people that have gone along this same path chime in.

All traffic is encrypted... can't be done.

Yeah, I just realized that after looking at my dumps

I think the bans are related to your eeprom. Also, if you want to sniff an encrypted line, you have to get the key.. that I have no clue how.. but it doesn't mean there isn't a way.. once you have the key, you could decrypt it on your "listening box" and pass it to the internet, re-encrypted.