Dedpoet
12-17-2002, 08:09 AM
I have a few proposed changes to the FAQ since the key sniffer change has made a few questions either obsolete, incomplete, or altogether wrong. Let's discuss this and put the changes in when we're all happy. I'll quote the original question, then put the proposed change below.
1.2 - What do I need to run ShowEQ?
In the broadest of terms: a 2nd computer, a Linux distribution, a hub and some time. And don't forget EverQuest with a non-banned account.
In the broadest of terms: a 2nd computer, a Linux distribution, a small key sniffing program running on your EverQuest computer, a hub and some time. And don't forget EverQuest with a non-banned account.
1.4 - Can ShowEQ be detected using software means by Sony?
The short answer is no. It would take a fair amount of work on their side to be able to tell that a NIC was in promiscuous mode (sniffing network traffic), and even then they would not be able to tell if it was tcpdump, ethereal or ShowEQ that was sniffing packets. ShowEQ is totally passive and transmits no data.
There has been much debate over this topic. If you run ShowEQ without a key sniffer (see section 2), then it is completely passive in nature, and nearly impossible to detect. If running a key sniffer on your EQ machine, the sniffer could arguably be detected with quite a bit of work on Sony's part. It is currently believed that Sony is not making any attempt to detect key sniffers, but this could change at any time.
1.7 - Does ShowEQ run on Microsoft Windows?
No, ShowEQ does not run on Microsoft Windows and it will never run on Microsoft Windows.
No, ShowEQ does not currenly run on Microsoft Windows. A Windows version will never be supported by the existing ShowEQ community, but there may be unsupported Windows versions out there now or in the future.
I recommend a new question 2.8, bumping all the rest down one number:
2.8 - How do I get ShowEQ to decode?
Once you have ShowEQ downloaded, compiled, and running, it should load up a map of your current zone, and show mob locations. However, all mobs will be listed as "unknown." To fix this, you have to run a key sniffer on your EQ computer to extract the decryption key and send it over to your ShowEQ computer. Check out the ShowEQ Key Sniffer Utility forum at http://seq.sourceforge.net for information on how to obtain, compile, and install a key sniffer.
2.15 How do I start ShowEQ once I have compiled and installed it?
From a terminal window type:
# su
# cd /usr/local/bin
# ./showeq -i eth0 --ip-address=10.10.10.6
This will monitor an EverQuest session that is coming from "10.10.10.6" on the network connected to your "eth0" network device.
# ./showeq --help
Will give you more command line options and switches with brief descriptions.
(This will now be 2.16) I would just add: If you are running a key sniffer, start it according to its directions, then start EverQuest.
4.9 - ShowEQ is working fine, but until it actually decodes I do not see any of the unknown spawns on the map. What is wrong?
The new default for ShowEQ is to NOT show these mobs. To see them, right click on the map and go to the "Show" menu. From there select the "Unknown Spawns" option.
With recent changes to the way mob info is sent from the EQ servers, you must be running a key sniffer on your EQ computer to see mobs decode. By default, ShowEQ will show all mobs as "unknown" until you tell it (via key sniffer) how to decode each zone. Please see the ShowEQ Key Sniffer Utilities forum on http://seq.sourceforge.net for information on these utilities.
Devs: Should the defaults for "Show Unknowns" and "Create Unknown Spawns" be changed to TRUE in CVS now? Without a sniffer, a default Seq install would show nothing at all as is, and would look like a network problem.
That's everything I have noticed so far. What do you guys think of these changes?
Edit: Chaned 1.2 per cheese_poker's suggestion, deleted the change to 4.17, and cleaned up sentence structures for clarity in a few places.
1.2 - What do I need to run ShowEQ?
In the broadest of terms: a 2nd computer, a Linux distribution, a hub and some time. And don't forget EverQuest with a non-banned account.
In the broadest of terms: a 2nd computer, a Linux distribution, a small key sniffing program running on your EverQuest computer, a hub and some time. And don't forget EverQuest with a non-banned account.
1.4 - Can ShowEQ be detected using software means by Sony?
The short answer is no. It would take a fair amount of work on their side to be able to tell that a NIC was in promiscuous mode (sniffing network traffic), and even then they would not be able to tell if it was tcpdump, ethereal or ShowEQ that was sniffing packets. ShowEQ is totally passive and transmits no data.
There has been much debate over this topic. If you run ShowEQ without a key sniffer (see section 2), then it is completely passive in nature, and nearly impossible to detect. If running a key sniffer on your EQ machine, the sniffer could arguably be detected with quite a bit of work on Sony's part. It is currently believed that Sony is not making any attempt to detect key sniffers, but this could change at any time.
1.7 - Does ShowEQ run on Microsoft Windows?
No, ShowEQ does not run on Microsoft Windows and it will never run on Microsoft Windows.
No, ShowEQ does not currenly run on Microsoft Windows. A Windows version will never be supported by the existing ShowEQ community, but there may be unsupported Windows versions out there now or in the future.
I recommend a new question 2.8, bumping all the rest down one number:
2.8 - How do I get ShowEQ to decode?
Once you have ShowEQ downloaded, compiled, and running, it should load up a map of your current zone, and show mob locations. However, all mobs will be listed as "unknown." To fix this, you have to run a key sniffer on your EQ computer to extract the decryption key and send it over to your ShowEQ computer. Check out the ShowEQ Key Sniffer Utility forum at http://seq.sourceforge.net for information on how to obtain, compile, and install a key sniffer.
2.15 How do I start ShowEQ once I have compiled and installed it?
From a terminal window type:
# su
# cd /usr/local/bin
# ./showeq -i eth0 --ip-address=10.10.10.6
This will monitor an EverQuest session that is coming from "10.10.10.6" on the network connected to your "eth0" network device.
# ./showeq --help
Will give you more command line options and switches with brief descriptions.
(This will now be 2.16) I would just add: If you are running a key sniffer, start it according to its directions, then start EverQuest.
4.9 - ShowEQ is working fine, but until it actually decodes I do not see any of the unknown spawns on the map. What is wrong?
The new default for ShowEQ is to NOT show these mobs. To see them, right click on the map and go to the "Show" menu. From there select the "Unknown Spawns" option.
With recent changes to the way mob info is sent from the EQ servers, you must be running a key sniffer on your EQ computer to see mobs decode. By default, ShowEQ will show all mobs as "unknown" until you tell it (via key sniffer) how to decode each zone. Please see the ShowEQ Key Sniffer Utilities forum on http://seq.sourceforge.net for information on these utilities.
Devs: Should the defaults for "Show Unknowns" and "Create Unknown Spawns" be changed to TRUE in CVS now? Without a sniffer, a default Seq install would show nothing at all as is, and would look like a network problem.
That's everything I have noticed so far. What do you guys think of these changes?
Edit: Chaned 1.2 per cheese_poker's suggestion, deleted the change to 4.17, and cleaned up sentence structures for clarity in a few places.