0900 is a net opcode. Do you have raw turned on and maybe are just being confused by the raw vs decoded packets in the log file? The 0900 will come out as the raw then the appropriate decoded application level packet will come out as decoded.