Am I right that internally libvirt uses only tcp ( ssh and tls are only encryption based on this) + ftp ( when working with image itself)? Also I have found that  it uses RPC. However, as I know RPC runs above tcp but I cannot capture these packets with wireshark when I am connecting remotely to the host with vm? Is it somehow possible to find out, what data, what messages, in what format are send from my server to the remote libvirt (daemon I suppose?)?