Bitcoin Core GUI Node Network Traffic Peaks

I assume this is a graph of network activity according to bitcoin-qt.

My hypothesis for the sharp peaks is that there is low-level chatter where nodes use small inventory messages to find out whether their peers have new data. Sometimes a peer has new data and the peak may indicate an actual bulk transfer of newly discovered data in a larger data message.

Newly discovered data can come from newly created unconfirmed transactions or newly mined blocks.

The only way to really verify this is to correlate network activity with Bitcoin log entries.

I use Wireshark or another network sniffer to capture and decode data being sent and received. I believe Wireshark has a protocol decoder for Bitcoin traffic.