[Console]::OutputEncoding = [Text.Encoding]::UTF8
$cap = "$env:TEMP\opencode\sym_close.pcap"
$ts = "C:\Program Files\Wireshark\tshark.exe"
Write-Host "=== stats by type (src dst udplen count) ==="
& $ts -r $cap -T fields -e ip.src -e ip.dst -e udp.length 2>$null | Group-Object { $p = $_ -split "`t"; "$($p[0]) -> $($p[1]) len=$($p[2])" } | Sort-Object Count -Descending | Select-Object -First 12 Count, Name | Format-Table -AutoSize
Write-Host "=== DMX stream (udplen=1092) per-5s buckets ==="
$dmx = @(& $ts -r $cap -Y "udp.length==1092" -T fields -e frame.time_relative 2>$null)
Write-Host ("total DMX frames: " + $dmx.Count)
$buckets = @{}
foreach ($t in $dmx) { $b = [int]([double]$t / 5); $buckets[$b] = 1 + [int]($buckets[$b] | ForEach-Object { $_ }) }
foreach ($k in ($buckets.Keys | Sort-Object)) { Write-Host ("  t={0,4}-{1,-4}s : {2} frames" -f ($k*5), ($k*5+5), $buckets[$k]) }
if ($dmx.Count -gt 0) { Write-Host ("  last DMX at t=" + $dmx[$dmx.Count-1]) }
Write-Host "=== AECH/AERE (udplen=560) ==="
& $ts -r $cap -Y "udp.length==560" -T fields -e frame.time_relative -e ip.src -e ip.dst 2>$null
Write-Host "=== last 15 frames overall ==="
& $ts -r $cap -T fields -e frame.time_relative -e ip.src -e ip.dst -e udp.length 2>$null | Select-Object -Last 15