#!/usr/bin/env python3
"""
Re-examine ALL packet lengths, not just ASCII ones
Maybe there's a pattern in the non-ASCII lengths too
"""

import struct

def parse_pcap(filename):
    with open(filename, 'rb') as f:
        f.read(24)  # Skip global header
        
        packets = []
        while True:
            packet_header = f.read(16)
            if len(packet_header) < 16:
                break
            
            ts_sec, ts_usec, incl_len, orig_len = struct.unpack('IIII', packet_header)
            packet_data = f.read(incl_len)
            if len(packet_data) < incl_len:
                break
            
            packets.append(incl_len)
        
        return packets

lengths = parse_pcap('sniffed.pcap')

print(f"Total packets: {len(lengths)}\n")
print("ALL packet lengths:")
print(lengths)
print()

# Look for patterns in large values
print("=" * 80)
print("ANALYZING LARGE VALUES (>= 256):")
print("=" * 80)

large_values = [(i+1, l) for i, l in enumerate(lengths) if l >= 256]
for pkt_num, length in large_values:
    # Try decoding as 2-byte chars (UTF-16 style)
    high_byte = (length >> 8) & 0xFF
    low_byte = length & 0xFF
    high_char = chr(high_byte) if 32 <= high_byte <= 126 else f"[{high_byte}]"
    low_char = chr(low_byte) if 32 <= low_byte <= 126 else f"[{low_byte}]"
    print(f"Packet {pkt_num:3d}: {length:5d} = 0x{length:04x} -> High:{high_char} Low:{low_char}")

# Try extracting high bytes
print("\n" + "=" * 80)
print("HIGH BYTES FROM LARGE VALUES:")
print("=" * 80)

high_bytes = [l >> 8 for l in lengths if l >= 256]
high_ascii = ''.join([chr(b) if 32 <= b <= 126 else f"[{b}]" for b in high_bytes])
print(f"High bytes: {high_bytes}")
print(f"As ASCII: {high_ascii}")

# Try extracting low bytes
print("\n" + "=" * 80)
print("LOW BYTES FROM LARGE VALUES:")
print("=" * 80)

low_bytes = [l & 0xFF for l in lengths if l >= 256]
low_ascii = ''.join([chr(b) if 32 <= b <= 126 else f"[{b}]" for b in low_bytes])
print(f"Low bytes: {low_bytes}")
print(f"As ASCII: {low_ascii}")

# Try alternating between large and small
print("\n" + "=" * 80)
print("PATTERN: SMALL vs LARGE PACKETS:")
print("=" * 80)

pattern = ""
for i, l in enumerate(lengths):
    if l < 256:
        pattern += "S"
    else:
        pattern += "L"

print(f"Pattern (S=small <256, L=large >=256):")
print(pattern)
print()

# Count transitions
print(f"Pattern analysis:")
small_count = pattern.count('S')
large_count = pattern.count('L')
print(f"  Small packets: {small_count}")
print(f"  Large packets: {large_count}")

# Look for runs
import re
runs = [(m.group(), len(m.group()), m.start()) for m in re.finditer(r'S+|L+', pattern)]
print(f"\n  Runs of same type:")
for run, length, pos in runs[:20]:
    print(f"    Position {pos:3d}: {run[0]} x {length}")

# Try interpreting S=0, L=1 as binary
binary_pattern = pattern.replace('S', '0').replace('L', '1')
print(f"\n  As binary (S=0, L=1): {binary_pattern[:80]}...")

# Split into bytes
print(f"\n  Interpreting as 8-bit groups:")
for i in range(0, min(80, len(binary_pattern)), 8):
    byte = binary_pattern[i:i+8]
    if len(byte) == 8:
        decimal = int(byte, 2)
        char = chr(decimal) if 32 <= decimal <= 126 else f"[{decimal}]"
        print(f"    {byte} -> {decimal:3d} -> {char}")