[Console]::OutputEncoding = [Text.Encoding]::UTF8
$cap = "$env:TEMP\opencode\sym_claim2.pcap"
$ts = "C:\Program Files\Wireshark\tshark.exe"
Write-Host "=== len=60 payload hex (mystery pre-claim frames) ==="
& $ts -r $cap -Y "udp.length==60 and ip.src==192.168.123.113" -T fields -e frame.time_relative -e udp.srcport -e udp.payload 2>$null
Write-Host ""
Write-Host "=== source ports of host frames (pre-claim) ==="
& $ts -r $cap -Y "ip.src==192.168.123.113 and frame.time_relative<354.8" -T fields -e udp.srcport 2>$null | Group-Object | Select-Object Count, Name
Write-Host ""
Write-Host "=== source port of ident + AECH ==="
& $ts -r $cap -Y "(udp.length==110 or udp.length==560) and frame.time_relative>=354" -T fields -e frame.time_relative -e udp.srcport 2>$null | Select-Object -First 5