Given the snippet of traffic involved, can they make an educated guess which links were compromised to get it? (It is DB replication traffic so if you know the

Given the snippet of traffic involved, can they make an educated guess which links were compromised to get it? (It is DB replication traffic so if you know the source DB and the dest DB then you can work out the route... in theory anyway, with Google Complexity, who knows...)