The approximately 11 hours I spent on this attack were well-spent. It was fun to be able to see so much from tcpdump logs. It was fun to see my assumptions be confirmed with later knowledge. I've learned to use the tool 'ethereal' to quickly browse through a lot of traffic-data. I updated my brains with knowledge about tcpdump, I didn't know it could already read encapsulated IPv6 traffic.

Well, to really come to a conclusion: it was fun. Besides that I hope I have answered the questions in a decent and clear manner so others can learn from my experiences too.