[Console]::OutputEncoding = [Text.Encoding]::UTF8
$cap = "$env:TEMP\opencode\sym_claim2.pcap"
$ts = "C:\Program Files\Wireshark\tshark.exe"
# 抓 ident 和第一个 AECH 质询的完整 hex (frame.time_epoch 精确定位)
Write-Host "=== ident102 (t=354.810) full hex ==="
& $ts -r $cap -Y "udp.length==110 and frame.time_epoch>=1789049091.467 and frame.time_epoch<=1789049091.468" -T fields -e udp.payload 2>$null
Write-Host ""
Write-Host "=== AECH challenge #1 (t=354.824) full hex ==="
& $ts -r $cap -Y "udp.length==560 and frame.time_epoch>=1789049091.481 and frame.time_epoch<=1789049091.482" -T fields -e udp.payload 2>$null
Write-Host ""
Write-Host "=== AERE #1 (t=354.826) 0xC0 前 96B ==="
$h = & $ts -r $cap -Y "udp.length==560 and frame.time_epoch>=1789049091.483 and frame.time_epoch<=1789049091.484" -T fields -e udp.payload 2>$null
if ($h) { $h.Substring(0, [Math]::Min(300, $h.Length)) }