I'm trying to get a better understanding of how Google docs makes and handles requests for changes in documents on the fly, and am wondering if there is something specific I could be monitoring with Wireshark.
Thank you.
Google Docs uses HTTPS to encrypt its communication. You cannot monitor any specific content-related changes, only witness that a user is contacting docs.google.com.
That said, if you're willing to delve into the realm of timing analysis, you may be able to reconstruct details from encrypted sessions. But this requires a significant amount of manual work.