[Console]::OutputEncoding = [Text.Encoding]::UTF8
$cap = "$env:TEMP\opencode\sym_claim2.pcap"
$ts = "C:\Program Files\Wireshark\tshark.exe"
Write-Host "=== ident(110) / 47B(55) / AECH-AERE(560) frames ==="
& $ts -r $cap -Y "udp.length==110 or udp.length==55 or udp.length==560" -T fields -e frame.time_relative -e frame.time_epoch -e ip.src -e ip.dst -e udp.length 2>$null
Write-Host ""
Write-Host "=== last discovery(188) + announce(652) before claim (restart boundary) ==="
& $ts -r $cap -Y "udp.length==188 or udp.length==652" -T fields -e frame.time_relative -e ip.src -e ip.dst -e udp.length 2>$null | Select-Object -Last 8