Thanks for the start. I can always modify it for larger strings and see what happens. As far as your analysis steps:

1. According to the vendor, it's encrypted. No word on how strong they beleive it is. I performed actions that caused known data to be sent, so it should be fairly simple to tell how strong the encryption is. The problem here is that I have no clue how to go about it.
2. The software is set up such that we can only use the two boxes it's installed on. I have run the same actions several different times, however, and there does appear to be similarities in the packet data.
3. Did not think of that, but it sounds like an interesting test. Will investigate how to do it.