import struct,ipaddress,datetime
f=open('/tmp/u443.pcap','rb'); gh=f.read(24)
end={b'\xd4\xc3\xb2\xa1':'<',b'\xa1\xb2\xc3\xd4':'>',b'\x4d\x3c\xb2\xa1':'<',b'\xa1\xb2\x3c\x4d':'>'}[gh[:4]]
while True:
    ph=f.read(16)
    if len(ph)<16: break
    ts,_,incl,_=struct.unpack(end+'IIII',ph); d=f.read(incl)
    if len(d)<incl: break
    et=struct.unpack('>H',d[12:14])[0]; o=14
    if et==0x8100: et=struct.unpack('>H',d[16:18])[0]; o=18
    if et!=0x0800: continue
    ihl=(d[o]&0xf)*4
    if d[o+9]!=17: continue
    src=str(ipaddress.IPv4Address(d[o+12:o+16])); t=o+ihl
    sp,dp,ul,cs=struct.unpack('>HHHH',d[t:t+8])
    pay=d[t+8:t+ul]
    print('%s  %s:%d len=%d' % (datetime.datetime.utcfromtimestamp(ts).strftime('%H:%M:%S'),src,sp,len(pay)))
    print('   %s' % pay[:48].hex())