Page 1 of 1

Studying the packet data

Posted: Mon May 27, 2019 7:22 pm
by Gangrenous
So if I want to study the packet data, what actually gets sent back and forth. How does one go about this properly? Do we have something better than just using wireshark? Can anyone give me a quick paragraph or two description on how you do it?

Re: Studying the packet data

Posted: Tue May 28, 2019 3:44 am
by Ememjr

Re: Studying the packet data

Posted: Tue May 28, 2019 5:15 am
by Gangrenous
Capture.JPG

Re: Studying the packet data

Posted: Tue May 28, 2019 11:08 am
by tyrbo
http://wiki.swganh.org/index.php/SOE_Protocol_Breakdown has a nice breakdown of how things more or less work.
https://github.com/Joshsora/LibSOE is a C# implementation (may not work for EQ2, never tested, but it looks close as well).
I have a networking implementation for DBG as well in Rust, but it's not publicly available.

There are some differences, but it's pretty close. I've never seen channels 1 through 3 utilized at all as far as EQ2 goes, so you can probably disregard those.

Going by that, you should be able to make some sense of what you're seeing in Wireshark, although the actual application packets are encrypted (seen in 0x09, 0x0D, 0x19, as well as 0x03 (which can contain a mix of encrypted/unencrypted)).

There is a packet analyzer which I believe is available on the public svn.
The collector is not publicly available, so you'll either have to get a copy, or find the old source it was built on top of (doable), or build your own based on the World source.