#!/usr/bin/env python3
"""
Generate conn-count-too-large.pcap — a DNS query with qd_count > dns_max_queries.
Set dns_max_queries to e.g. 3 in the test to trigger DNS_Conn_count_too_large.

Generated by Claude Sonnet 4.6 (Anthropic).
"""

import struct
from pathlib import Path

from scapy.all import IP, UDP, Ether, Raw, wrpcap

SRC = "1.2.3.4"
DST = "5.6.7.8"


def dns_many_questions(num_questions):
    """Build a raw DNS query with num_questions identical questions."""
    txid = 0xABCD
    flags = 0x0100  # standard query, recursion desired
    qdcount = num_questions
    ancount = arcount = nscount = 0
    header = struct.pack("!HHHHHH", txid, flags, qdcount, ancount, nscount, arcount)

    # Each question: example.com A IN
    qname = b"\x07example\x03com\x00"
    qtype_class = struct.pack("!HH", 1, 1)  # A, IN
    question = qname + qtype_class

    return header + question * num_questions


def main():
    payload = dns_many_questions(10)  # 10 questions; lower dns_max_queries to 3 in test

    pkt = (
        Ether() / IP(src=SRC, dst=DST) / UDP(sport=12345, dport=53) / Raw(load=payload)
    )

    out = Path(__file__).with_suffix("")  # strip .py
    wrpcap(str(out), [pkt])
    print(f"Wrote {out}")


if __name__ == "__main__":
    main()
