Announcement

**rswiders** · 02-08-2021, 22:51

The session detection logic is triggering on local ip addresses that are not where the eq client is running. Is there a way to filter local packets to only the listening ip?

You can see below that it is listening on 192.168.0.21 (Listening on '\Device\NPF_{98ED437E-51F3-4C94-88D9-A29E6282A2A2} : name:eth3 (Intel(R) Ethernet Connection (2) I219-V) on /192.168.0.21 /fe80:0:0:0:65d4:dab2:c105:a5d1%eth3'). That should be the packets that are processed on a local ip address.

Code:

DEVICE=0 is interface: \Device\NPF_Loopback : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=1 is interface: \Device\NPF_{4EA3A6F0-AC92-4912-B187-4FB53FD280C2} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=2 is interface: \Device\NPF_{CFC35797-83EA-4364-BAE7-088DF6CA160C} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=3 is interface: \Device\NPF_{2AE13859-7D80-4328-A1FE-63B969F223D5} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=4 is interface: \Device\NPF_{38050301-D15D-48B3-A2BF-51ECB553F8B9} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=5 is interface: \Device\NPF_{DBB1A90A-B736-40B9-BE3E-46B509D1E5E7} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=6 is interface: \Device\NPF_{D83F5346-1C6D-4645-93A1-9A861D582082} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=7 is interface: \Device\NPF_{7C8BD631-B553-49C8-9FE2-783C20A20E3B} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=8 is interface: \Device\NPF_{98ED437E-51F3-4C94-88D9-A29E6282A2A2} : name:eth3 (Intel(R) Ethernet Connection (2) I219-V) on /192.168.0.21 /fe80:0:0:0:65d4:dab2:c105:a5d1%eth3
DEVICE=9 is interface: \Device\NPF_{4C95ABFA-CFF0-403B-AF35-9F34FD1FC8ED} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
Waiting for client...
Client Version: 2.4.8.8
Lore Op Code: 0x74c3
Book Op Code: 0x9f20
Link Op Code: 0x555a
Adv Op Code: 0x6586
Item Ignore Op Code: 0x0
Recipe Op Code: 0x0
RecipeList Op Code: 0x0
Mode is 1
Autodection is 1
Allow Item Discovery 1
Item Preview Op Code: 0x74c3
Item Reward Op Code: 0xfec
Server Operations Completed...
ItemStore: items.db
Listening on '\Device\NPF_{98ED437E-51F3-4C94-88D9-A29E6282A2A2} : name:eth3 (Intel(R) Ethernet Connection (2) I219-V) on /192.168.0.21 /fe80:0:0:0:65d4:dab2:c105:a5d1%eth3'
Added PCL
Downloading Item Fields Definitions for debug purposes...
Downloading complete
Downloading Bad CharmFiles...
Download failed.
BAD CHARMS V.0.1 @ 2020-04-20 13:12 UTC
Good ip count is 2
Filtering packets for local addresses and ...
69.174
192.168.0.21
User Name: SwiftyMUSE
Debugging Level: 0xf (info, warnings, extra info, zone packet info)
ItemCollect based on EQitems on 13th-floor.org
-- Press 'y' to display a * when packet is being processed (switch on / off) --
-- Press 'z' to display a count of packets processed --
-- Press 'f' to flush the item store --
-- Press 'p' to reset pcap filter --
-- Press 'd' to download latest version --
-- Press 'c' to reupload all charm text info (it will wipe the file when done) --
-- Press 'i' to packet filter --
-- Press 'q' to exit --

**Deillusional** · 02-08-2021, 23:39

It was checking an opcode for session start and end, now it checks for the opcode and size in 2.4.8.9, can you check if that helps?

**Deillusional** · 02-08-2021, 23:42

Originally posted by rswiders View Post

The session detection logic is triggering on local ip addresses that are not where the eq client is running. Is there a way to filter local packets to only the listening ip?

You can see below that it is listening on 192.168.0.21 (Listening on '\Device\NPF_{98ED437E-51F3-4C94-88D9-A29E6282A2A2} : name:eth3 (Intel(R) Ethernet Connection (2) I219-V) on /192.168.0.21 /fe80:0:0:0:65d4:dab2:c105:a5d1%eth3'). That should be the packets that are processed on a local ip address.

Code:

DEVICE=0 is interface: \Device\NPF_Loopback : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=1 is interface: \Device\NPF_{4EA3A6F0-AC92-4912-B187-4FB53FD280C2} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=2 is interface: \Device\NPF_{CFC35797-83EA-4364-BAE7-088DF6CA160C} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=3 is interface: \Device\NPF_{2AE13859-7D80-4328-A1FE-63B969F223D5} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=4 is interface: \Device\NPF_{38050301-D15D-48B3-A2BF-51ECB553F8B9} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=5 is interface: \Device\NPF_{DBB1A90A-B736-40B9-BE3E-46B509D1E5E7} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=6 is interface: \Device\NPF_{D83F5346-1C6D-4645-93A1-9A861D582082} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=7 is interface: \Device\NPF_{7C8BD631-B553-49C8-9FE2-783C20A20E3B} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
DEVICE=8 is interface: \Device\NPF_{98ED437E-51F3-4C94-88D9-A29E6282A2A2} : name:eth3 (Intel(R) Ethernet Connection (2) I219-V) on /192.168.0.21 /fe80:0:0:0:65d4:dab2:c105:a5d1%eth3
DEVICE=9 is interface: \Device\NPF_{4C95ABFA-CFF0-403B-AF35-9F34FD1FC8ED} : name:lo (Software Loopback Interface 1) on /127.0.0.1 /0:0:0:0:0:0:0:1
Waiting for client...
Client Version: 2.4.8.8
Lore Op Code: 0x74c3
Book Op Code: 0x9f20
Link Op Code: 0x555a
Adv Op Code: 0x6586
Item Ignore Op Code: 0x0
Recipe Op Code: 0x0
RecipeList Op Code: 0x0
Mode is 1
Autodection is 1
Allow Item Discovery 1
Item Preview Op Code: 0x74c3
Item Reward Op Code: 0xfec
Server Operations Completed...
ItemStore: items.db
Listening on '\Device\NPF_{98ED437E-51F3-4C94-88D9-A29E6282A2A2} : name:eth3 (Intel(R) Ethernet Connection (2) I219-V) on /192.168.0.21 /fe80:0:0:0:65d4:dab2:c105:a5d1%eth3'
Added PCL
Downloading Item Fields Definitions for debug purposes...
Downloading complete
Downloading Bad CharmFiles...
Download failed.
BAD CHARMS V.0.1 @ 2020-04-20 13:12 UTC
Good ip count is 2
Filtering packets for local addresses and ...
69.174
192.168.0.21
User Name: SwiftyMUSE
Debugging Level: 0xf (info, warnings, extra info, zone packet info)
ItemCollect based on EQitems on 13th-floor.org
-- Press 'y' to display a * when packet is being processed (switch on / off) --
-- Press 'z' to display a count of packets processed --
-- Press 'f' to flush the item store --
-- Press 'p' to reset pcap filter --
-- Press 'd' to download latest version --
-- Press 'c' to reupload all charm text info (it will wipe the file when done) --
-- Press 'i' to packet filter --
-- Press 'q' to exit --

Could maybe make it an option but it is possible to run on a separate computer it checks for private IP addresses and the darkpaw address range.

**rswiders** · 02-08-2021, 23:51

Originally posted by Deillusional View Post

Could maybe make it an option but it is possible to run on a separate computer it checks for private IP addresses and the darkpaw address range.

Or allow for a way to specify which local address/addresses to filter? The ip filtering (for private addresses) should probably be moved from the bad charmfile and a local configuration file.

**Deillusional** · 03-08-2021, 08:55

Let me know how it goes, and thanks for the help/suggestions:

Version 2.5.0.0

General

Removed the timed * echo.

IP Filtering

Controlled via ipaddresses.ini this file is created on load if it doesn't exist. Otherwise is customisable. To reload it use i

[IP_FILTER]
COUNT = 1
USE = 1
LOCAL_IP =
IP_1 = 69.174

LOCAL_IP is if you want to search for a starting packet of an ip address range or a single IP e.g. 192.168 will take every ip address in 192.168. as valid, 192.168.0.2 will only take 192.168.0.2 as valid

the IP_x is enable filters from the external addresses starting with the address.

Sessions

Client Detection is on ports 9000-9007 now.

Session Response takes the size of the packet into account as well as the opcode.
Session Disconnect takes the size of the packet into account as well as the opcode.

**rswiders** · 03-08-2021, 13:22

I'm loading up the newest version now. I will keep you informed. The last version was working much better. It had been detecting a new session every 5-20 minutes but last night I had several hours of it accepting data. I just wanted to make sure this was working for me before we hit the new beta season so we can get everything updated then.

**Deillusional** · 03-08-2021, 14:14

yer i think you caught a version when I was messing on with it, it was bugged for like 5 minutes or so.

**Deillusional** · 03-08-2021, 14:22

im going to run it on my pi all the time and see what happens now too (dont ask about jpcap for it its a god damn pain).

Welcome!

Announcement

Session detection logic

Session detection logic

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment