TCPdump filter:
    dst port 3724

Ethereal filter:
    tcp.len != 0 && tcp.len != 10 && tcp.len != 14
    tcp.len != 0 && tcp.len != 10 && tcp.len != 14 && tcp.len != 30
    tcp.len != 0 && tcp.len != 10 && tcp.len != 14 && tcp.len != 18 && tcp.len != 30




6 byte frames
----------------
    - hearthstone finishes activating, returning to intended town
    - listing the people currently on in my guild


7 byte frames
----------------
    - picking up EQ from a corpse


11 byte frames
----------------
    - consuming food
    - consuming drink
    - activating hearthstone


20 byte frames
----------------
    - shooting my fireball


22 byte frames
----------------
    - listing my current bids at the AH
    - placing a bid at the AH
    - having a vendor repair all of my items
    - asking a flight master to start flying me
    - /wave, /dance, /smile, etc...


23 byte frames
----------------
    - selling an item at the vendor


30 byte frames
----------------
    - walking


36 byte frames
----------------
    - typing "/who"


38 byte frames
----------------
    - searching at the AH (it seems that this is true, no matter how many search parameters are set)
    - pressing "next" in a search at the AH


48 byte frames
----------------
    - searching at the AH for a string that's 10 characters long


49 byte frames
----------------
    - searching at the AH for a string that's 11 characters long



50 byte frames
----------------
    - jumping




"/say spam"         19 bytes
"/say spamy"        20 bytes
"/say spamye"       21 bytes
"/2 eieio"          38 bytes

    All text typed is clearly seen in each frame.
    However, the rest of the frame isn't necessarily intelligable.



/say marker chicken
/chicken
/chicken
/chicken
/chicken
/say marker wave
/wave
/wave
/wave
/wave



/dance
    22 bytes long
    7th byte is always 0x22

/smile
    22 bytes long
    7th byte is always 0xa3

/wave
    22 bytes long
    7th byte is always 0x65

/chicken
    22 bytes long
    7th byte is always 0x16

    /applaud        0x05 0x00
    /beg            0x08 0x00
    /bow            0x11 0x00
    /chicken        0x16 0x00
    /cry            0x1f 0x00
    /dance          0x22 0x00
    /eat            0x25 0x00
    /flex           0x29 0x00
    /kiss           0x3a 0x00
    /kneel          0x3b 0x00
    /laugh          0x3c 0x00
    /point          0x48 0x00
    /roar           0x4b 0x00
    /rude           0x4d 0x00
    /salute         0x4e 0x00

    /attacktarget   0x33 0x01
    /bye            0x13 0x00
    /charge         0x31 0x01


when you /wave with nobody selected, the last 8 bytes are always all 0's

/wave at a horde guard (lvl40)          2b 74 00 00  00 70 00 f0

/wave at player "Deshwitat"             55 19 39 00  00 00 00 00
/wave at player "Scurn"                 62 8b 85 00  00 00 00 00
/wave at player "Mashman"               06 48 82 00  00 00 00 00
/wave at player "Deshwitat"             55 19 39 00  00 00 00 00
/wave at player "Kaz"                   76 85 7f 00  00 00 00 00

/wave at xroads wind rider              58 4d 00 00  00 70 00 f0
/wave at xroads innkeeper               51 5f 09 00  00 a0 00 f0
/wave at ogrimmar wind rider            75 51 00 00  00 70 00 f0
/wave at ogrimmar banker                59 77 00 00  00 70 00 f0
/wave at auctioneer "wabang"            65 51 00 00  00 70 00 f0
/wave at auctioneer "kresky"            71 51 00 00  00 70 00 f0