Page 1 of 1
Can't get EQ2PacketCollector.exe to collect packets
Posted: Mon May 10, 2010 7:58 am
by Eradani
I've got WinPcap_4_1_1.exe running
I run EQ2PacketCollector.exe and have 4 nic options. I'm 99% sure #4 is the connected nic, but I tried all of them just to be sure.
On each try, I get
Waiting for EQ2 to start.
Success!
Everything looks good.
Listening on Network adapter '....' on local host
and then nothing.
Finally, I just let it run on #4 nic about 6:00 and just as I logged in a my old partner showed up so I chatted while:
doing crafting writs in my guild hall for a bit on one toon
switched to another and did more writs
switched to another and went looking for some pvp
cl -> dlw -> cl -> ant -> sh
there was never anything on dos window until some error msgs about this time
logged out around 9:15
New EQ2 stream found
5/9/2010 08:27:50
67.225.4.97 -> 74.201.99.117
0000: 00 01 00 40 01 48 29 00 84 67 BE 18 6C 3D E1 4A ...@.H)..g..l=.J
0010: AE 72 D6 2C 00 03 00 04 00 00 00 00 00 06 00 1C .r.,............
0020: 34 30 30 36 36 38 35 31 34 32 3A 31 3A 36 36 35 4006685142:1:665
0030: 30 36 33 30 33 39 3A 31 00 00 00 00 00 08 00 14 063039:1........
0040: 68 6D 61 63 2D 6E 6F 74 2D 69 6D 70 6C 65 6D 65 hmac-not-impleme
0050 6E 74 65 64 nted
10 more of these with the same time stamp.
If anyone would care to help me figure this out, I'll boot up IRC and keep checking there and here.
Re: Can't get EQ2PacketCollector.exe to collect packets
Posted: Tue May 11, 2010 5:58 pm
by John Adams
Eradani, I'll reply to your PM here as well.
First, what OS are you using? If it's Vista or Windows 7, I am not going to be of much help since I am still an XP hold-out.
Also, be sure you do not ZONE unless you absolutely have to while collecting. 1 zone where a new Key is not retrieved will render the collect useless.
The NIC you want to pick is not a dialup or generic adapter, but probably has the same name in it as you'd find if you looked in Device Manager under network interfaces.
Code: Select all
1. rpcap://\Device\NPF_GenericDialupAdapter (Network adapter 'Adapter for generi
c dialup and VPN capture' on local host)
2. rpcap://\Device\NPF_{938BBE35-5A59-4D7D-BBAC-C76C01C1664C} (Network adapter 'NVIDIA nForce MCP Networking Adapter Driver (Microsoft's Packet Scheduler) ' on local host)
Enter the interface number (1-2):
For mine, it's #2 - my NVIDIA nForce driver.
When collecting, you should see a EQ2 Key: and some hex characters when you first log in, and again when you enter the world. If you do not see a new key everytime you zone, the log is broken and should be restarted (ie., log out, rename EQ2PacketLog.log and restart collector, log back in).
You should not ever run Collector -after- you log in. Only before you enter your name and password in the client/launcher to connect.
The log size will be about 4mb per 10 mins I believe, depending on where you are or what you're doing. You can easily see if it's collecting properly by opening the log and searching for some text that you said in chat, or examining some spells or items and searching for words in the names of those items.
I have no idea what "hmac not implemented" means. I would make sure the WinPCap you installed is the same one we recommended, and that it's compatible with your OS, and of course that you pick the NIC that your computer receives EQ2 data through. Not sure why you have 4 NICs, but maybe that's a fancy motherboard thing
Re: Can't get EQ2PacketCollector.exe to collect packets
Posted: Tue May 11, 2010 7:38 pm
by Eradani
lol, i'd still be using win 98 if i could. i am also an xp holdout
I wasn't going to zone, but nothing happened so the last time (when i got the error msgs) i just carried on and checked every once in awhile and there was never anything at all on dos window until those errors. i'd restarted it several times previous to this.
1. start up WinPcap_4_1_1.exe (as per
here ->
here Supported platforms: Windows NT4/2000 Windows XP/2003/Vista/2008/Win7/2008R2 (x86 and x64))
2. start up EQ2PacketCollector.exe (as per url you gave me)
3. start up eq2.exe
Code: Select all
Loading ignore list from IgnoreList.txt...
Note that all ignored names are case sensitive!!
INFO: Added xxxx to ignore list.
1. rpcap://\Device\NPF_(....) (Network adapter 'NVIDIA nForce MCP Adapter Driver' on local host)
2. rpcap://\Device\NPF_(....) (Network adapter 'NVIDIA nForce MCP Adapter Driver' on local host)
3. rpcap://\Device\NPF (...) (Network adapter 'Microsoft MAC Bridge Virtual NIC' on local host)
4. rpcap://\Device\NPF (...) (Netword adapter 'Bigfoot' on local host)
Enter the interface number (1-4): 4
Waiting for EQ2 to start.
Success!
Everything looks good.
Listening on Network adapter 'Bigfoot' on local host
i use my killer nic card which would be 4.
EQ2PacketCollecter.exe - 200k - 2009/09/27
zlib1.dll - 59k - 2007/11/13
i guess what i could try is using a different port for getting on-line and trying that. maybe there's something weird about my card. this is so frustrating as every day that goes by means less data i can collect. i'm all set up on testcopy atm and could make an 80 with no quests done, mentor down and plow through nek, nek castle, ts, rov as fast as i could click on everything.
Re: Can't get EQ2PacketCollector.exe to collect packets
Posted: Tue May 11, 2010 8:10 pm
by Zcoretri
You don't mean to say you start winpcap every time do you? That should be a one time install, no need to start that executable after installation...just start the collector .exe and then EQ2
A typical session upon logging in should look similar to this if working correctly.
Code: Select all
Enter the interface number (1-4):4
Waiting for EQ2 to start.
Success!
Everything looks good.
Listening on Network adapter 'Microsoft' on local host
Current key from EQ2: 1c93ba0c03e1a257
Allocating Space for fragmented packet total size: 741
Allocating Space for fragmented packet total size: 518
Allocating Space for fragmented packet total size: 18454
Allocating Space for fragmented packet total size: 1711
Current key from EQ2: 20e6977e4f2fa2c1
Allocating Space for fragmented packet total size: 4272
Allocating Space for fragmented packet total size: 18450
Allocating Space for fragmented packet total size: 4106
Allocating Space for fragmented packet total size: 5020
Allocating Space for fragmented packet total size: 1320
Allocating Space for fragmented packet total size: 1911
Allocating Space for fragmented packet total size: 646
Allocating Space for fragmented packet total size: 59873
Allocating Space for fragmented packet total size: 3674
Allocating Space for fragmented packet total size: 1013
Allocating Space for fragmented packet total size: 1203
Allocating Space for fragmented packet total size: 531
Allocating Space for fragmented packet total size: 1932
Allocating Space for fragmented packet total size: 4009
500 packets: 587 recv, 0 drop, 0 ifdrop, 553 capt
Allocating Space for fragmented packet total size: 1181
Allocating Space for fragmented packet total size: 586
Allocating Space for fragmented packet total size: 511
Allocating Space for fragmented packet total size: 508
Allocating Space for fragmented packet total size: 2402
Allocating Space for fragmented packet total size: 5013
Allocating Space for fragmented packet total size: 740
Allocating Space for fragmented packet total size: 5747
Allocating Space for fragmented packet total size: 1760
Allocating Space for fragmented packet total size: 1680
Allocating Space for fragmented packet total size: 5644
Re: Can't get EQ2PacketCollector.exe to collect packets
Posted: Wed May 12, 2010 7:24 am
by John Adams
Just curious why you wouldn't use NIC 1 or 2... what the heck is a Bigfoot? lol
Re: Can't get EQ2PacketCollector.exe to collect packets
Posted: Wed May 12, 2010 7:31 am
by Eradani
a) another name for Sasquatch
b) Bigfoot is a brandname (or something) of my Killer Nic Card.
grrr the post i was making didn't get there as you posted, but to summarize:
quote="Zcoretri"]You don't mean to say you start winpcap every time do you? That should be a one time install, no need to start that executable after installation...just start the collector .exe and then EQ2[/quote]
When i installed winpcap, it had an option to start automatically with windows and i disabled this. I ran it and checked msinfo32 and it was, indeed, not running. So i reinstalled and rebooted and now it's running.
Tried running eq2packetcollector again and still nothing.
Going to try the other ports now
Re: Can't get EQ2PacketCollector.exe to collect packets
Posted: Wed May 12, 2010 7:57 am
by Eradani
Well that did it!!
Plugged into what's called Local Area Connection 2 in my system tray. BUT had to select option 1 from packet collector menu.
Off to collecting now.
Re: Can't get EQ2PacketCollector.exe to collect packets
Posted: Thu May 13, 2010 7:03 am
by John Adams
Excellent. Looking forward to your collects.
As Zcoretri said, no need for WinPCap to be "running" at all. We're just using a driver that gets installed with it to hook the NIC.