It must have something to do with a integrity check value in the code. It would help if we could get the sniffed packages of two trainers during the same exchange, and the same extraction of the same pokemons getting back to their owner again.
That way we could get a pattern on which values...