After more investigation with a TCP server in debug mode, I have found that the packets are far less cryptic than I thought first (the problem with Wireshark is to find *all* packets containing data... and I missed some, that's why I could not understand first the structure)
However, if anybody knows the exact definition of the header, that would be helpful (I do not like to write code based only on assumptions which may crash if an unpexpected packet is receiving)