[Console]::OutputEncoding = [Text.Encoding]::UTF8
$ts = "C:\Program Files\Wireshark\tshark.exe"
# sub=07 特征: type=02 帧 0x18-0x19 = 07 00。用 payload 前缀过滤: ENet + 02 + ...+ 0700
# udp.payload hex 的 0x18-0x19 字节 = 第 48-51 字符
foreach ($cap in @("$env:TEMP\opencode\sym_claim2.pcap", "$env:TEMP\opencode\cold2.pcap", "$env:TEMP\opencode\sym_close.pcap")) {
    Write-Host ("=== " + (Split-Path $cap -Leaf) + " : type=02 sub=07 frames ===")
    & $ts -r $cap -Y "udp[16:2]==0x0700 and ip.src==192.168.123.113 and udp.length<200" -T fields -e frame.time_relative -e udp.length -e udp.payload 2>$null | ForEach-Object { $p = $_ -split "`t"; "{0,9:N1}s len={1} {2}" -f [double]$p[0], $p[1], $p[2].Substring(0, [Math]::Min(104, $p[2].Length)) } | Select-Object -First 12
    Write-Host ""
}