import struct,ipaddress,datetime
path='/tmp/r443.pcap'
f=open(path,'rb'); gh=f.read(24)
end={b'\xd4\xc3\xb2\xa1':'<',b'\xa1\xb2\xc3\xd4':'>',b'\x4d\x3c\xb2\xa1':'<',b'\xa1\xb2\x3c\x4d':'>'}[gh[:4]]
link=struct.unpack(end+'I',gh[20:24])[0]
n=0
print('time      sport   flags  pay  note')
while True:
    ph=f.read(16)
    if len(ph)<16: break
    ts,_,incl,_=struct.unpack(end+'IIII',ph); d=f.read(incl)
    if len(d)<incl: break
    if link!=1: continue
    et=struct.unpack('>H',d[12:14])[0]; o=14
    if et==0x8100: et=struct.unpack('>H',d[16:18])[0]; o=18
    if et!=0x0800: continue
    ihl=(d[o]&0xf)*4
    if d[o+9]!=6: continue
    src=str(ipaddress.IPv4Address(d[o+12:o+16])); t=o+ihl
    if src!='62.33.118.242': continue
    if len(d)<t+20: continue
    sp,dp=struct.unpack('>HH',d[t:t+4])
    fl=d[t+13]; doff=(d[t+12]>>4)*4; pay=max(0,len(d)-(t+doff))
    flags=''.join(c for b,c in ((fl&0x02,'S'),(fl&0x10,'A'),(fl&0x01,'F'),(fl&0x08,'P'),(fl&0x04,'R')) if fl&b)
    note=''
    if pay>0:
        p=d[t+doff:]
        if p and p[0]==0x16 and len(p)>5 and p[5]==0x01: note='ClientHello'
        elif p and p[0]==0x17: note='appdata/tunnel'
        elif p and p[0]==0x16: note='TLS record'
        else: note='data'
    elif 'S' in flags and 'A' not in flags: note='SYN (ping/проверка порта)'
    print('%s  %-6d %-6s %-4d %s' % (datetime.datetime.utcfromtimestamp(ts).strftime('%H:%M:%S'), sp, flags, pay, note))
    n+=1
print('total from user IP =',n)