For larger attachments, Retain will send an HTTP "get" command to the GroupWise POA to retrieve the attachment. That conversation is outside of SOAP, so you will not see the transfer. In such cases, you'll need to run tcpdump from a command prompt. The following are instructions for Linux. The same general concepts could be applied to Windows machines.
Worker Local to the POA
tcpdump -s0 -w /[path]/[filename].pcap -i lo 'port 7191'
Example: tcpdump -s0 -w /var/log/retain-tomcat7/trace.pcap -i lo 'port 7191'
Worker on Retain Server or Other Server Remote to the POA