If you succeed in spoofing, you don't have to worry about triggering alarms doing a lot of normal things in the system, as you appear to be a legitimate user, as opposed to hopefully not appearing at all. My guess is that if you fail to sniff the traffic you could try to sniff again if it's still there (but it probably won't be considering how fast the mesh is), so you'll need more logon info to sniff. Failing to spoof would probably get the Firewall to realize that the user is doing something strange, likely triggering the space-version of Google not letting you in and wanting more authentication when you log on from a strange location. In either case, you attract less attention from failure, and once you have the logon info, you should be able to retest until it's changed (which will vary greatly by the security of the system, and the efficacy of the spoofed user's Muse).