Both Godra and myself are getting the same results with our tests, so we first have to figure why you are getting something different to make sure I am looking at the correct Wireshark information. The only thing I can think of is maybe the test you ran was on 3.98s and our test was on 3.98t. Can you run the same test on 3.98t and do another WireShark capture?
Is it possible that you have another software on your PC running in the background such as an OPC server that may be communicating with your controller?