import struct,collections,ipaddress,sys
for path,proto in (('/tmp/r443.pcap','TCP'),('/tmp/u443.pcap','UDP')):
    try: f=open(path,'rb')
    except Exception as e: print(path,e); continue
    gh=f.read(24)
    if len(gh)<24: print('%s: EMPTY' % path); continue
    end={b'\xd4\xc3\xb2\xa1':'<',b'\xa1\xb2\xc3\xd4':'>',b'\x4d\x3c\xb2\xa1':'<',b'\xa1\xb2\x3c\x4d':'>'}[gh[:4]]
    link=struct.unpack(end+'I',gh[20:24])[0]
    cnt=collections.Counter(); ports=collections.Counter(); first=None; last=None
    while True:
        ph=f.read(16)
        if len(ph)<16: break
        ts,_,incl,_=struct.unpack(end+'IIII',ph); d=f.read(incl)
        if len(d)<incl: break
        if first is None: first=ts
        last=ts
        if link!=1: continue
        et=struct.unpack('>H',d[12:14])[0]; o=14
        if et==0x8100: et=struct.unpack('>H',d[16:18])[0]; o=18
        if et==0x0800:
            ihl=(d[o]&0xf)*4
            if d[o+9]!=6 and d[o+17]!=17: continue
            src=str(ipaddress.IPv4Address(d[o+12:o+16])); t=o+ihl
        elif et==0x86DD:
            src=str(ipaddress.IPv6Address(d[o+8:o+24])); t=o+40
        else: continue
        if len(d)<t+4: continue
        sp,dp=struct.unpack('>HH',d[t:t+4])
        cnt[src]+=1; ports[(src,dp)]+=1
    print('=== %s  packets=%d  span=%s..%s ===' % (proto,sum(cnt.values()),
        __import__('datetime').datetime.utcfromtimestamp(first).strftime('%H:%M:%S') if first else '-',
        __import__('datetime').datetime.utcfromtimestamp(last).strftime('%H:%M:%S') if last else '-'))
    for ip,c in cnt.most_common(15):
        flag='  <== USER' if ip=='62.33.118.242' else ''
        print('   %-40s %d%s' % (ip,c,flag))
    print()