---

sudo /bin/sh -s -- 1791353820 194.186.63.28 60642 utun10 60657 <<'CAPTURE'
set -u
export TZ=UTC LC_ALL=C
tb_at=$1 tb_peer=$2 tb_port=$3 tb_tun=$4 tb_dns=$5
tb_now=$(date +%s)
[ "$tb_at" -gt "$((tb_now + 3))" ] && [ "$tb_at" -le "$((tb_now + 600))" ] || { echo 'Start window missed; no capture.'; exit 1; }
tb_flow() {
  netstat -an -p tcp | awk -v src="192.168.77.2.$tb_port" -v dst="$tb_peer.443" \
    '$4 == src && $5 == dst && $6 == "ESTABLISHED" {print; found=1} END {if (!found) exit 1}'
}
tb_validate() {
  [ "$(sysctl -n net.inet.tcp.tso)" = 0 ] || return 1
  [ "$(route -n get 172.21.0.1 | awk '/interface:/ {print $2}')" = "$tb_tun" ] || return 1
  tb_actual_dns=$(scutil --dns | awk '/^resolver #1$/ {active=1; next} active && /^resolver #/ {exit} active && $1 == "port" {print $3; exit}')
  [ "$tb_actual_dns" = "$tb_dns" ] || return 1
  tb_flow
}
tb_validate || { echo 'Current flow/TSO/route/DNS differs; no capture.'; exit 1; }
umask 077
tb_dir=$(mktemp -d /private/tmp/tbvpngw-m4-sync.XXXXXX) || exit 1
tb_pids=''
tb_stop() {
  trap '' HUP INT TERM
  if [ -n "$tb_pids" ]; then
    kill -INT $tb_pids 2>/dev/null || :
    sleep 1
    kill -KILL $tb_pids 2>/dev/null || :
    wait $tb_pids 2>/dev/null || :
    tb_pids=''
  fi
}
tb_cleanup() {
  tb_stop
  rm -f "$tb_dir/outer.headers" "$tb_dir/inner.headers" "$tb_dir/dns.headers" \
        "$tb_dir/outer.stderr" "$tb_dir/inner.stderr" "$tb_dir/dns.stderr"
  rmdir "$tb_dir"
}
trap tb_cleanup EXIT
trap 'exit 130' HUP INT TERM
echo "ARMED epoch=$tb_at; UTC clock=$(date -u '+%Y-%m-%dT%H:%M:%SZ')"
while [ "$(date +%s)" -lt "$tb_at" ]; do sleep 0.2; done
[ "$(date +%s)" -le "$((tb_at + 1))" ] && tb_validate || { echo 'Start/state changed; no capture.'; exit 1; }
echo "CAPTURE_START $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
tcpdump -p --immediate-mode -l -nn -tt -S -K -vv -i bridge0 -y EN10MB -s 54 \
  "ip and tcp and host $tb_peer and port 443 and port $tb_port" >"$tb_dir/outer.headers" 2>"$tb_dir/outer.stderr" &
tb_pids="$tb_pids $!"
tcpdump -p --immediate-mode -l -nn -tt -S -K -vv -i "$tb_tun" -y NULL -s 44 \
  'ip and ((tcp and port 443) or (host 172.21.0.1 and port 53))' >"$tb_dir/inner.headers" 2>"$tb_dir/inner.stderr" &
tb_pids="$tb_pids $!"
tcpdump -p --immediate-mode -l -nn -tt -S -K -vv -i lo0 -y NULL -s 44 \
  "ip and host 127.0.0.1 and port $tb_dns" >"$tb_dir/dns.headers" 2>"$tb_dir/dns.stderr" &
tb_pids="$tb_pids $!"
sleep 2
for tb_name in outer inner dns; do
  grep -q 'listening on' "$tb_dir/$tb_name.stderr" || { cat "$tb_dir/$tb_name.stderr"; exit 1; }
done
while [ "$(date +%s)" -lt "$((tb_at + 5))" ]; do sleep 0.2; done
echo "REQUEST_START $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
curl -q --noproxy '*' --ipv4 --silent --show-error --connect-timeout 8 --max-time 20 \
  --output /dev/null --write-out 'CURL http=%{http_code} dns=%{time_namelookup} tcp=%{time_connect} tls=%{time_appconnect} first=%{time_starttransfer} total=%{time_total} bytes=%{size_download} local=%{local_ip}:%{local_port} remote=%{remote_ip}\n' \
  https://my.vk.team/
echo "CURL_EXIT=$? REQUEST_END $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
while [ "$(date +%s)" -lt "$((tb_at + 30))" ]; do sleep 0.2; done
tb_flow || echo 'Corporate flow changed during the request; comparison limited.'
tb_stop
echo "CAPTURE_END $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
for tb_name in outer inner dns; do
  echo "--- $tb_name capture diagnostics ---"
  cat "$tb_dir/$tb_name.stderr"
  echo "--- $tb_name first/last header lines (summary only) ---"
  awk '{if (NR<=12) print; recent[NR%16]=$0} END {if (NR>12) {print "..."; start=NR-15; if(start<13)start=13; for(i=start;i<=NR;i++)print recent[i%16]}}' "$tb_dir/$tb_name.headers"
done
echo 'All three M4 captures stopped and reaped; temporary header files will now be removed.'
CAPTURE