---

(
  tb_bridge=$(/sbin/ifconfig bridge0)
  case "$tb_bridge" in
    *'inet 192.168.77.2 '*) ;;
    *) echo 'Stop: run this on M4.'; exit 1 ;;
  esac
  tb_original=$(printf '%s\n' "$tb_bridge" | awk '/options=/{print}')
  case "$tb_original" in
    *'options=63<RXCSUM,TXCSUM,TSO4,TSO6>'*) ;;
    *) echo 'Stop: offload flags differ from the baseline.'; exit 1 ;;
  esac

  tb_routes() {
    for tb_target in 10.12.165.142 172.21.0.1; do
      tb_if=$(/sbin/route -n get "$tb_target" | awk '/interface:/{print $2}')
      [ "$tb_if" = utun10 ] || { echo "Stop: $tb_target uses $tb_if."; return 1; }
    done
  }
  tb_flow() {
    netstat -an -p tcp | awk '/194[.]186[.]63[.]/ && /ESTABLISHED/ {print $4, $5}'
  }
  tb_probe() {
    date -u
    netstat -an -p tcp | awk '/194[.]186[.]63[.]/ && /ESTABLISHED/ {print}'
    /usr/bin/nc -4 -n -z -v -G 6 -w 6 10.12.165.142 8443
    /usr/bin/dig @172.21.0.1 jss.corp.mail.ru A +time=4 +tries=1 +notcp +ignore +noall +comments +answer
    netstat -an -p tcp | awk '/194[.]186[.]63[.]/ && /ESTABLISHED/ {print}'
  }

  tb_routes || exit 1
  tb_initial_flow=$(tb_flow)
  [ -n "$tb_initial_flow" ] || { echo 'Stop: no corporate TCP connection.'; exit 1; }
  sudo -v || exit 1

  echo 'BASELINE: TSO enabled'
  tb_probe
  tb_routes || exit 1

  tb_restore() {
    trap - EXIT
    echo 'Restoring original TSO setting:'
    if sudo -n /sbin/ifconfig bridge0 tso; then
      tb_restored=$(/sbin/ifconfig bridge0 | awk '/options=/{print}')
      printf '%s\n' "$tb_restored"
      [ "$tb_restored" = "$tb_original" ] || echo 'WARNING: restored flags differ from the original.'
    else
      echo 'Restore failed. Run: sudo /sbin/ifconfig bridge0 tso'
    fi
  }
  trap tb_restore EXIT
  trap 'exit 130' HUP INT TERM

  sudo -n /sbin/ifconfig bridge0 -tso || exit 1
  tb_disabled=$(/sbin/ifconfig bridge0 | awk '/options=/{print}')
  printf '%s\n' "$tb_disabled"
  case "$tb_disabled" in
    *'options=3<RXCSUM,TXCSUM>'*) ;;
    *) echo 'Stop: expected TSO-only change did not take effect.'; exit 1 ;;
  esac

  echo 'TSO disabled temporarily; waiting 10 seconds for queued traffic.'
  sleep 10
  tb_routes || exit 1
  echo 'COMPARISON: TSO disabled'
  tb_probe
  tb_routes || exit 1

  if [ "$(tb_flow)" = "$tb_initial_flow" ]; then
    echo 'Corporate TCP connection is unchanged.'
  else
    echo 'Corporate TCP connection changed; comparison is inconclusive.'
  fi
)