getting packets

Hi Team

Ive been using showeq many years ago and am considering myself decent into linux.
I decided to take it up again and compiled 6.3.9 from tarball and updated via diff method
Ive done this on two different distros ( Linux Mint and now Centos 7 )

i start showeq as root and get gui and all the nice stuff..i see packets arriving ( # increasing in the status bar ) ..but im not getting any decodes at all...like nothing.
I tried using both Mirrorring and a dedicated network TAP device . - and as mentioned i get packets # incrementing

I see the packet when sniffing the port with Wireshark..However i do not get a decode as mentioned..This kind of ruins my view of myself as a decent linux guy...

Lol...so ..please help me as to where to probably start troubleshoot.

( i am testing against 2 diff TLP servers )

tia !

You say you compiled 6.3.9 and updated via diff, but 6.3.9 is the current release and includes the latest diff so no additional update should have been necessary. Did you accidentally unapply (reverse apply) the update diff? That would definitely cause decode failure.

thanks @cn187 this is likely what i actually did …ill try to wipe installation and start from scratch and report back here :-)

ps:
instead of wiping the laptop and restarting…anyway to remove which core showeq folders/files in one go to sort of having a clean slate to retry on ?
pps:
showeq works on tlp also right ( Mischief )

hmm..

Decided to wipe all showeq related files/directories. Reinstalled.
Getting packets but no decode.

Weird..wonder what im doing wrong


Attachment 874

Attachment 875

terminal output

( not too worried about maps and eqstr files yet )

sniffer machine is on a port listening to mirrorered trafic and has a static ip on the em1 nic in the same range as the eq host machine

created a vm ( vmware ) and it worked right away

Glad you got it going. My wife and I were out all day yesterday, so I didn't get to check the forum after we left.

For future reference -

Doing "make uninstall" should remove the files you installed, though I haven't audited it to verify that it doesn't miss any files. Though, doing make install should overwrite anything that changes, so you may not need to do this.

For the source tree itself, you can just delete the directory and start from a fresh source (either unpacking the tarball, or a clean checkout from svn).

thanks cn187 ..and merry xmas to you and family

( got it working on both vmware workstation AND on a linuxmint 19.3 box with a dedicated sharktap 10/100/1G TAP...amazing stuff still.

Bonus info:

I do beleive that working with showeq many many many years ago ..was what eased me into "Linux" as a great tool & OS...so..the analogy is had i never found everquest...i may never have learned to use Linux :-)

Glad you got it running snpp.

ShowEQ is what made me learn linux many many moons ago. Now I am an Redhat Administrator...and run this site...funny how life works out.

Merry Christmas.