tools of the trade

[spectre]

I'm wanting to start to learn how to analyze the packets, and i havent done any of this before. i have basic C and C++ knowledge and am plugging through the code figuring out what's happening. What tools are people using to analyze the packets? any quick pointers in how to start?

[Alfred]

http://seq.sourceforge.net/showthread.php?s=&threadid=2774

[spectre]

i've read that thread. what i'm asking for is what tools people use themselves to analyze the packets? if anyone has any tricks to help them notice things in the packets, any tips to make people's life easier, etc.

[fee]

A good place to start is with the Network->Log->All function. It will log all packets to the default file /usr/local/share/showeq/global.log This file contains the UDP payload of all packets to or from the EQ client. Its in a pretty difficult to read form. Spend some time with this data to get a feel for what it is you might be interested in.


I have a handful of utils I keep around for parsing these packets out. But more often than not I look at the data in hex. After a while you'll get a feel for it and things will start to become obvious.

Fee