# Writes a pcap: one TCP session 10.0.0.5:40000 -> 203.0.113.9:443 with a 600 s idle gap
# (longer than Zeek's tcp_inactivity_timeout = 5 min), then a fresh connection from a new port.
import struct, sys
out = open(sys.argv[1], 'wb')
out.write(struct.pack('<IHHiIII', 0xa1b2c3d4, 2, 4, 0, 0, 65535, 1))
def ip(a): return bytes(int(x) for x in a.split('.'))
def pkt(t, src, sp, dst, dp, flags, seq, ack, payload=b''):
    tcp = struct.pack('!HHIIBBHHH', sp, dp, seq, ack, 5 << 4, flags, 65535, 0, 0) + payload
    iph = struct.pack('!BBHHHBBH4s4s', 0x45, 0, 20 + len(tcp), 1, 0, 64, 6, 0, ip(src), ip(dst))
    frame = b'\x00\x11\x22\x33\x44\x55' + b'\x66\x77\x88\x99\xaa\xbb' + b'\x08\x00' + iph + tcp
    sec = int(t); usec = int(round((t - sec) * 1e6))
    out.write(struct.pack('<IIII', sec, usec, len(frame), len(frame)) + frame)
SYN, ACK, PSH, FIN = 0x02, 0x10, 0x08, 0x01
C, S = '10.0.0.5', '203.0.113.9'
t0 = 1793400000.0
cs, ss = 1000, 5000
pkt(t0, C, 40000, S, 443, SYN, cs, 0); cs += 1
pkt(t0+0.05, S, 443, C, 40000, SYN|ACK, ss, cs); ss += 1
pkt(t0+0.10, C, 40000, S, 443, ACK, cs, ss)
# heartbeat every 60 s for 30 min (stays alive)
t = t0 + 1
for i in range(30):
    pkt(t, C, 40000, S, 443, PSH|ACK, cs, ss, b'x'*20); cs += 20
    pkt(t+0.05, S, 443, C, 40000, PSH|ACK, ss, cs, b'y'*40); ss += 40
    t += 60
# idle 600 s, then resume heartbeats for 30 min more, then FIN
t += 600
for i in range(30):
    pkt(t, C, 40000, S, 443, PSH|ACK, cs, ss, b'x'*20); cs += 20
    pkt(t+0.05, S, 443, C, 40000, PSH|ACK, ss, cs, b'y'*40); ss += 40
    t += 60
pkt(t, C, 40000, S, 443, FIN|ACK, cs, ss); cs += 1
pkt(t+0.05, S, 443, C, 40000, FIN|ACK, ss, cs); ss += 1
pkt(t+0.10, C, 40000, S, 443, ACK, cs, ss)
out.close()