Page 2 of 2 FirstFirst 12
Results 16 to 25 of 25

Thread: 10/21 patch

  1. #16
    Administrator
    Join Date
    Oct 2019
    Posts
    496

    Re: 10/21 patch

    I don't think that's the global EQ stuff either (despite being in the global log).

    I think that's unrelated LAN traffic that's getting captured and misinterpreted as being an EQ packet.

    Note that the destination address ends in .255 - that's the broadcast address for the local subnet. All the EQ traffic should be point to point (AFAIK)

  2. #17
    Registered User
    Join Date
    Dec 2019
    Posts
    36

    Re: 10/21 patch

    Yea the past two months i haven't had to change anything, I always specify my IP address and everything has been working fine. probably about 6 months ago, i would occasionally not work when I did monitor next eq client seen so once i switched it all worked great.

  3. #18
    Did you SEQ today? BlueAdept's Avatar
    Join Date
    Dec 2001
    Posts
    2,003

    Re: 10/21 patch

    IDK. At least there is a workaround. I dont know enough to diag it any further.
    Filters for ShowEQ can now be found here. filters-5xx-06-20-05.tar.gz

    ShowEQ file section is here. https://sourceforge.net/project/show...roup_id=10131#

    Famous Quotes:

    Ratt: WTF you talkin' about BA? (Ok.. that sounds like a bad combo of Diffrent Strokes and A-Team)

    Razzle: I showeq my wife

  4. #19
    Administrator
    Join Date
    Oct 2019
    Posts
    496

    Re: 10/21 patch

    My initial impression was that something in the protocol changed, but honestly, the whole problem may just be local LAN traffic getting misinterpreted. Maybe I should spend some time trying to tune the capture filters. I think ignoring broadcast and multicast traffic would be low-hanging fruit that would likely have some decent results. Limiting the capture to traffic going to/from DBG's IP block could be helpful too, though that should probably be configurable.

  5. #20
    Administrator
    Join Date
    Oct 2019
    Posts
    496

    Re: 10/21 patch

    I don't think that's the issue. For example I don't see any world traffic on 9000 OR 9001, but rather a different port 900x port.

    Looking at a wireshark capture, there are a series of packets sent by the login server that show what world server and port should be used depending on the server you want to connect to.

    As an example:

    Code:
    0040   00 00 00 00 17 00 00 00 65 71 77 6f 72 6c 64 2d   ........eqworld-
    0050   30 33 2e 65 76 65 72 71 75 65 73 74 2e 63 6f 6d   03.everquest.com
    0060   00 2f 23 00 00 00 00 00 00 21 01 00 00 66 00 00   ./#......!...f..
    0070   00 42 65 72 74 6f 78 78 75 6c 6f 75 73 20 2d 20   .Bertoxxulous - 
    0080   53 61 72 79 72 6e 00 45 4e 00 55 53 00 00 00 00   Saryrn.EN.US....
    0090   00 01 00 00 00 65 71 77 6f 72 6c 64 2d 30 32 2e   .....eqworld-02.
    00a0   65 76 65 72 71 75 65 73 74 2e 63 6f 6d 00 2a 23   everquest.com.*#
    00b0   00 00 00 00 00 00 21 01 00 00 68 00 00 00 42 72   ......!...h...Br
    00c0   69 73 74 6c 65 62 61 6e 65 20 2d 20 54 68 65 20   istlebane - The 
    00d0   54 72 69 62 75 6e 61 6c 00 45 4e 00 55 53 00 00   Tribunal.EN.US..
    00e0   00 00 00 02 00 00 00 65 71 77 6f 72 6c 64 2d 30   .......eqworld-0
    00f0   32 2e 65 76 65 72 71 75 65 73 74 2e 63 6f 6d 00   2.everquest.com.
    0100   28 23 00 00 00 00 00 00 21 01 00 00 69 00 00 00   (#......!...i...
    0110   43 61 7a 69 63 2d 54 68 75 6c 65 20 2d 20 46 65   Cazic-Thule - Fe
    0120   6e 6e 69 6e 20 52 6f 00 45 4e 00 55 53 00 00 00   nnin Ro.EN.US...
    0130   00 00 03 00 00 00 65 71 77 6f 72 6c 64 2d 30 32   ......eqworld-02
    0140   2e 65 76 65 72 71 75 65 73 74 2e 63 6f 6d 00 2d   .everquest.com.-
    0150   23 00 00 00 00 00 00 21 01 00 00 6a 00 00 00 44   #......!...j...D
    0160   72 69 6e 61 6c 20 2d 20 4d 61 65 6c 69 6e 20 53   rinal - Maelin S
    0170   74 61 72 70 79 72 65 00 45 4e 00 55 53 00 00 00   tarpyre.EN.US...
    0180   00 00 04 00 00 00 65 71 77 6f 72 6c 64 2d 30 31   ......eqworld-01
    0190   2e 65 76 65 72 71 75 65 73 74 2e 63 6f 6d 00 28   .everquest.com.(
    01a0   23 00 00 00 00 00 00 21 01 00 00 6d 00 00 00 45   #......!...m...E
    01b0   72 6f 6c 6c 69 73 69 20 4d 61 72 72 20 2d 20 54   rollisi Marr - T
    01c0   68 65 20 4e 61 6d 65 6c 65 73 73 00 45 4e 00 55   he Nameless.EN.U
    01d0   53 00 00 00 00 00 05 00 00 00 65 71 77 6f 72 6c   S.........eqworl
    01e0   64 2d 30 31 2e 65 76 65 72 71 75 65 73 74 2e 63   d-01.everquest.c
    01f0   6f 6d 00 2c 23 00 00 00 00 00 00 21 01 00 00 6f   om.,#......!...o
    0200   00 00 00 46 69 72 69 6f 6e 61 20 56 69 65 20 28   ...Firiona Vie (
    0210   52 6f 6c 65 70 6c 61 79 69 6e 67 20 50 72 65 66   Roleplaying Pref
    So it looks like Bertox uses eqworld03 on 9007, Bristlebane uses eqworld02 on 9002, Cazic uses eqworld02 on 9000, etc.

    I'm guessing either you were testing on a different server than previously, or perhaps they swapped the ports around on the back-end during the patch.

    But in any event, it would appear that SEQ hasn't been picking up the world server traffic in the majority of cases if it's only listening on 9000.

    Honestly, I don't know what world-level stuff SEQ uses (other than just logging), so I don't know if we should expand the filters (or detect the port and change it on the fly) to handle all of the various world server ports, or if it's fine as is.

  6. #21
    Developer
    Join Date
    Oct 2010
    Posts
    214

    Re: 10/21 patch

    The code where it locks onto what IP address you're playing on (if you haven't specified it on the command line or in your .xml file) is in packet.cpp at the very beginning of function EQPacket::dispatchPacket. The m_detectingClient variable is True if you haven't specified an IP. All the two "if" statements do is test that and then check if the packet source or dest port is 9000. If it is, it locks onto that IP address.

    If they're using a different ports now, then you'd have to change the "if" statements to detect a range of ports, once you figure out what that range is.

    The packetfilter strings in packetcapture.cpp would need to be changed to a range check too. I'm not sure why they're pulling bytes out and comparing them to 9000 instead of using the "portrange" keyword, maybe that was the only way to do it back then.

  7. #22
    Administrator
    Join Date
    Oct 2019
    Posts
    496

    Re: 10/21 patch

    Yeah, I'm working on the changes to the if statements as we speak. And I agree about the portrange. I think I'll try to adjust the captures to use that instead, and also to filter broadcast/multicast like I mentioned earlier.

  8. #23
    Administrator
    Join Date
    Oct 2019
    Posts
    496

    Re: 10/21 patch

    Also, range looks to be 9000-9007. I've got a patch compiling now for testing. I'll post it once I've verified it checks out.

  9. #24
    Administrator
    Join Date
    Oct 2019
    Posts
    496

    Re: 10/21 patch

    Here's a patch to expand the capture filters and the client detection to use the full 9000-9007 world server port range. It also filters out broadcast and multicast traffic, so that should quiet down the logs a bit regarding weird packets (like BlueAdept's example from upthread).

    Running around in game, it seems fine. I've tried it with/without session tracking, and with/without specifying my host IP and haven't had any noticeable issues.
    Attached Files Attached Files

  10. #25
    Did you SEQ today? BlueAdept's Avatar
    Join Date
    Dec 2001
    Posts
    2,003

    Re: 10/21 patch

    I have tested the patch and it does seem to rectify the network issue. Therefore I have updated the SVN and File section with the fix.

    Thanks again!
    Filters for ShowEQ can now be found here. filters-5xx-06-20-05.tar.gz

    ShowEQ file section is here. https://sourceforge.net/project/show...roup_id=10131#

    Famous Quotes:

    Ratt: WTF you talkin' about BA? (Ok.. that sounds like a bad combo of Diffrent Strokes and A-Team)

    Razzle: I showeq my wife

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

You may post new threads
You may post replies
You may post attachments
You may edit your posts
HTML code is Off
vB code is On
Smilies are On
[IMG] code is On