12 lines
793 B
PowerShell
12 lines
793 B
PowerShell
|
[Console]::OutputEncoding = [Text.Encoding]::UTF8
|
||
|
|
$cap = "$env:TEMP\opencode\sym_claim2.pcap"
|
||
|
|
$ts = "C:\Program Files\Wireshark\tshark.exe"
|
||
|
|
Write-Host "=== len=60 payload hex (mystery pre-claim frames) ==="
|
||
|
|
& $ts -r $cap -Y "udp.length==60 and ip.src==192.168.123.113" -T fields -e frame.time_relative -e udp.srcport -e udp.payload 2>$null
|
||
|
|
Write-Host ""
|
||
|
|
Write-Host "=== source ports of host frames (pre-claim) ==="
|
||
|
|
& $ts -r $cap -Y "ip.src==192.168.123.113 and frame.time_relative<354.8" -T fields -e udp.srcport 2>$null | Group-Object | Select-Object Count, Name
|
||
|
|
Write-Host ""
|
||
|
|
Write-Host "=== source port of ident + AECH ==="
|
||
|
|
& $ts -r $cap -Y "(udp.length==110 or udp.length==560) and frame.time_relative>=354" -T fields -e frame.time_relative -e udp.srcport 2>$null | Select-Object -First 5
|