Packet opcodes and structs are reverse engineered from the client. You can find a bit about that from the WPP project Packets have a header and a body. In the header it's defined the direction (client->server, server->client), the timestamp it was sent, the opcode id and some other fields. The body is simply a bunch of bytes that only make sense once the opcode is known. Here's an example of reading a packet: https://github.com/TrinityCore/WowPacketParser/blob/master/WowPacketParser/Parsing/Parsers/GuildHandler.cs#L705-L712