---

sudo /bin/sh <<'TB_DELIVERY'
export TZ=UTC
tb_tso=$(/usr/sbin/sysctl -n net.inet.tcp.tso) || exit 1
echo "TCP TSO=$tb_tso"
[ "$tb_tso" = 0 ] || { echo 'Stop: TSO differs from the previous sample.'; exit 1; }

tb_route=$(/sbin/route -n get 172.21.0.1) || exit 1
printf '%s\n' "$tb_route" | awk '/route to:|gateway:|interface:/ {print}'
case "$tb_route" in
  *'interface: utun10'*) ;;
  *) echo 'Stop: corporate DNS is no longer on utun10.'; exit 1 ;;
esac

tb_flow() {
  /usr/sbin/netstat -an -p tcp |
    awk '/194[.]186[.]63[.]/ && /ESTABLISHED/ {print $4, $5}'
}
tb_before=$(tb_flow)
[ -n "$tb_before" ] || { echo 'Stop: no corporate TCP connection.'; exit 1; }

date -u
/usr/sbin/netstat -an -p tcp | awk '/194[.]186[.]63[.]/ && /ESTABLISHED/ {print}'

tb_pids=''
tb_cleanup() {
  trap - EXIT
  kill -INT $tb_pids 2>/dev/null || :
  sleep 1
  kill -KILL $tb_pids 2>/dev/null || :
  wait $tb_pids 2>/dev/null || :
}
trap tb_cleanup EXIT
trap 'exit 130' HUP INT TERM

/usr/sbin/tcpdump -p --immediate-mode -l -nn -tttt -S -K -i bridge0 -y EN10MB -s 54 -c 160 'ip and tcp and net 194.186.63.0/24 and port 443 and host 192.168.77.2' &
tb_pids="$tb_pids $!"

/usr/sbin/tcpdump -p --immediate-mode -l -nn -tttt -q -K -i utun10 -y NULL -s 32 -c 8 'ip and udp and host 172.21.0.1 and port 53 and port 53053' &
tb_pids="$tb_pids $!"

sleep 2
echo 'Identified corporate DNS probe (source port 53053):'
/usr/bin/dig -b '0.0.0.0#53053' @172.21.0.1 www.apple.com A +time=5 +tries=1 +notcp +ignore +noall +comments +answer

sleep 5
/usr/sbin/netstat -an -p tcp | awk '/194[.]186[.]63[.]/ && /ESTABLISHED/ {print}'
if [ "$(tb_flow)" = "$tb_before" ]; then
  echo 'Corporate TCP connection unchanged.'
else
  echo 'Corporate TCP connection changed; comparison is limited.'
fi
date -u
echo 'Stopping both captures now. A capture that hit its packet cap covers only its printed interval.'
TB_DELIVERY