how about instead of sending hexed packets which would be a great Idea you encrypt the functions with numbers instead.
Example;
challenge other person code would be 102195
or some other kind of code.
Each packet is a compiled set of data.
First two bytes is the header. (0x0000)
After that is a set of data.
The server and client have customized sets of handlers for each packet, verification's etc.
All data passes from Client <-> Server
is editable.
But if edited the data will be processed to the point where if edited, there would be no profitable outcome.
For example let us look at map to map movement.
Say user is in Map 1 and he needs to get to Map 5 but he would need to go through Map 2-4 just to get to 5. So he thinks why not edit the portal from Map 1 to Map 2 to take him to Map 5. The server will see this packet and check it against possible Maps to be moved to. If the user is trying to move from Map 1 to Map 5 (which the server will recognize is impossible,) the server would automatically boot/ban the user for hacking
If that did not make since I'll give you another example, lets look at wild Pokemon encounters.
So lets say on Map 1 you can only encounter Pidgeys and the user sends a packet from that map saying he encountered a Charzard, the server will check possible encounters and if it is possible to encounter that Pokemon on that Map, if it isn't the server will boot/ban the user.
So truthfully "Security" on packets does not need to be advanced for that much it needs basically no protection, the only reason I used hex packets is because it is an easy encryption and I have a lot of experience working with hex packets.
Now the reason we use Headers is because we can easily identify the packets.
For example;
Server -
Client Version Check is "00" ("0x0000")
Client -
Server Version Validation is "00" ("0x0000")
It will not always be the same number, because one process may contain multiple unique packets to properly work.
Another reason this helps is because it severely prevents simple hacks such as "Money Editing," we can prevent users from generating money even through Cheat Engine because the client always confirms amounts back to the server. And even if you spoof the packets eventually it will end with the sheer fact that if the server says you have 100 currency you can only spend 100.