[Console]::OutputEncoding = [Text.Encoding]::UTF8
$cap = "$env:TEMP\opencode\sym_claim2.pcap"
$ts = "C:\Program Files\Wireshark\tshark.exe"
Write-Host "=== ALL host-sent frames before claim (t<354.8): dst x udp.len x count + first/last t ==="
$all = @(& $ts -r $cap -Y "ip.src==192.168.123.113 and frame.time_relative<354.5" -T fields -e frame.time_relative -e ip.dst -e udp.length 2>$null)
$groups = @{}
foreach ($l in $all) { $p = $l -split "`t"; $k = $p[1] + " len=" + $p[2]; if (-not $groups.ContainsKey($k)) { $groups[$k] = New-Object System.Collections.ArrayList }; [void]$groups[$k].Add([double]$p[0]) }
foreach ($k in ($groups.Keys | Sort-Object)) {
    $arr = $groups[$k]
    Write-Host ("{0,-30} n={1,-5} first={2:N1}s last={3:N1}s" -f $k, $arr.Count, $arr[0], $arr[$arr.Count-1])
}
Write-Host ""
Write-Host "=== ALL device-sent frames before claim (t<354.8) ==="
$dev = @(& $ts -r $cap -Y "ip.src==192.168.123.1 and frame.time_relative<354.5" -T fields -e frame.time_relative -e ip.dst -e udp.length 2>$null)
$g2 = @{}
foreach ($l in $dev) { $p = $l -split "`t"; $k = $p[1] + " len=" + $p[2]; if (-not $g2.ContainsKey($k)) { $g2[$k] = 0 }; $g2[$k]++ }
foreach ($k in ($g2.Keys | Sort-Object)) { Write-Host ("{0,-30} n={1}" -f $k, $g2[$k]) }
Write-Host ""
Write-Host "=== EUCE (548) timing before claim ==="
& $ts -r $cap -Y "udp.length==548" -T fields -e frame.time_relative 2>$null | Select-Object -First 20