how to decode the keystrokes from the pcap