---

(
tb_report=$(mktemp "$HOME/Desktop/tbvpn-m4-headers.XXXXXX")
sudo /bin/bash >"$tb_report" <<'CAPTURE'
export LC_ALL=C
umask 077
tb_flow() {
  lsof -nP -iTCP -sTCP:ESTABLISHED -Fpcn | awk '
    /^p/ {ok=0}
    /^c/ {ok=tolower(substr($0,2)) ~ /viscosity|openvpn/}
    ok && /^n192[.]168[.]77[.]2:[0-9]+->[0-9.]+:443$/ {print substr($0,2)}'
}
tb_connection=$(tb_flow)
[ "$(printf '%s\n' "$tb_connection" | awk 'NF {n++} END {print n+0}')" = 1 ] || {
  echo 'Need one corporate TCP connection; no capture started.' >/dev/tty
  exit 1
}
tb_peer=${tb_connection#*->}; tb_peer=${tb_peer%:443}
[ "$(route -n get "$tb_peer" | awk '/interface:/ {print $2}')" = bridge0 ] || {
  echo 'Corporate peer route changed; no capture started.' >/dev/tty
  exit 1
}
tb_tun=$(route -n get 10.102.240.208 | awk '/interface:/ {print $2}')
case "$tb_tun" in utun[0-9]*) ;; *) exit 1;; esac
tb_dns=$(scutil --dns | awk '
  /^resolver #1$/ && !seen {seen=1; active=1; next}
  active && /^resolver #/ {exit}
  active && $1=="port" {print $3; exit}')
case "$tb_dns" in ''|*[!0-9]*) echo 'DNS port unavailable; no capture started.' >/dev/tty; exit 1;; esac

tb_dir=$(mktemp -d /private/tmp/tbvpn-m4-browser.XXXXXX) || exit 1
tb_pids=()
tb_marker_pid=''
tb_stop_marker() {
  if [ -n "$tb_marker_pid" ]; then
    kill -TERM "$tb_marker_pid" 2>/dev/null || :
    kill -KILL "$tb_marker_pid" 2>/dev/null || :
    wait "$tb_marker_pid" 2>/dev/null || :
    tb_marker_pid=''
  fi
}
tb_stop() {
  tb_stop_marker
  if [ "${#tb_pids[@]}" -gt 0 ]; then
    kill -TERM "${tb_pids[@]}" 2>/dev/null || :
    sleep 1
    kill -KILL "${tb_pids[@]}" 2>/dev/null || :
    wait "${tb_pids[@]}" 2>/dev/null || :
    tb_pids=()
  fi
}
tb_cleanup() {
  trap '' INT TERM HUP
  tb_stop
  rm -f "$tb_dir/outer" "$tb_dir/inner" "$tb_dir/dns" \
        "$tb_dir/outer.err" "$tb_dir/inner.err" "$tb_dir/dns.err"
  rmdir "$tb_dir"
  echo "M4_CLEANUP $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
  echo 'M4 cleanup complete: all captures stopped.' >/dev/tty
}
trap tb_cleanup EXIT
trap 'exit 130' INT TERM HUP XFSZ
ulimit -f 32768

echo "M4_START $(date -u '+%Y-%m-%dT%H:%M:%SZ') flow=$tb_connection inner=$tb_tun dns=$tb_dns"
sysctl net.inet.tcp.tso

tcpdump -p --immediate-mode -nn -U -i bridge0 -y EN10MB -s 54 \
  -w "$tb_dir/outer" \
  "ip and ((tcp and host $tb_peer and port 443) or (icmp and (host $tb_peer or host 192.168.77.1)))" \
  2>"$tb_dir/outer.err" &
tb_pids+=("$!")

tcpdump -p --immediate-mode -nn -U -i "$tb_tun" -y NULL -s 44 \
  -w "$tb_dir/inner" \
  'ip and ((tcp and port 443 and (host 10.102.240.208 or host 176.112.168.113)) or (host 172.21.0.1 and port 53))' \
  2>"$tb_dir/inner.err" &
tb_pids+=("$!")

tcpdump -p --immediate-mode -nn -U -i lo0 -y NULL -s 44 \
  -w "$tb_dir/dns" "ip and host 127.0.0.1 and port $tb_dns" \
  2>"$tb_dir/dns.err" &
tb_pids+=("$!")

sleep 2
for tb_name in outer inner dns; do
  grep -q 'listening on' "$tb_dir/$tb_name.err" || {
    echo "Capture $tb_name failed; stopping." >/dev/tty
    cat "$tb_dir/$tb_name.err"
    exit 1
  }
done

ping -n -c 36 -i 5 -W 500 -s 8 "$tb_peer" >/dev/null 2>&1 &
tb_marker_pid=$!
echo "M4_READY flow=$tb_connection inner=$tb_tun dns=$tb_dns $(date -u '+%Y-%m-%dT%H:%M:%SZ')" >/dev/tty
echo 'Paste M4_READY into chat. Wait for GO before pressing Return here.' >/dev/tty

IFS= read -r -t 180 tb_go </dev/tty || {
  echo 'Waiting limit reached; stopping captures.' >/dev/tty
  exit 1
}
tb_stop_marker
for tb_pid in "${tb_pids[@]}"; do
  kill -0 "$tb_pid" 2>/dev/null || exit 1
done
[ "$(tb_flow)" = "$tb_connection" ] || {
  echo 'Corporate connection changed; do not reload.' >/dev/tty
  exit 1
}

echo "M4_GO $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
ping -n -c 2 -i 0.2 -W 500 -s 8 192.168.77.1 >/dev/null 2>&1 || :
ping -n -c 2 -i 0.2 -W 500 -s 8 "$tb_peer" >/dev/null 2>&1 || :
echo 'RELOAD JIRA ONCE NOW. Captures stop automatically after 65 seconds.' >/dev/tty
echo "RELOAD_PROMPT $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
sleep 65
tb_stop

echo "M4_END $(date -u '+%Y-%m-%dT%H:%M:%SZ')"
echo "FINAL_FLOW $(tb_flow)"
for tb_name in outer inner dns; do
  echo "CAPTURE $tb_name bytes=$(wc -c <"$tb_dir/$tb_name")"
  cat "$tb_dir/$tb_name.err"
  echo "BEGIN_PCAP $tb_name"
  /usr/bin/base64 -i "$tb_dir/$tb_name"
  printf '\nEND_PCAP %s\n' "$tb_name"
done
CAPTURE
printf 'Report saved: %s\n' "$tb_report"
)