Packet Monitor Program - iSROBOT

maghack · 04/20/2006, 12:20

Hello Guys..

does anyone know any program which can monitors the packets in/out an ip address?

I plan to capture all the packets in and out of the CHina server from my computer..

hopefully this program allow me to filter and edit the packets too

It should work like a windows packet editor.. but it seems WPE doesn't work on ISROBOT because the processors are all done by silk.dll

Mag

duun · 04/20/2006, 12:53

maybe you should try ETHEREAL

fant0m · 04/20/2006, 15:54

Quote:

Originally posted by duun@Apr 20 2006, 12:53
maybe you should try ETHEREAL

QFT. Ethereal will work.

Let us know what happens.

betaboon · 04/20/2006, 17:50

i did it with ETR-->ethereal^^

asdasd11 · 04/20/2006, 18:30

Can you please post all the IP/s the bot tries to access?

betaboon · 04/20/2006, 20:33

i posted it in another post! would have to search for but dont have time for it

fant0m · 04/21/2006, 04:52

Quote:

Originally posted by asdasd11@Apr 20 2006, 18:30
Can you please post all the IP/s the bot tries to access?

why do you need this? Ethereal will tell you. the bot sends and recieves a UDP packet on port 5228 or so.

maghack · 04/21/2006, 04:58

anyway the ip address
is 202.101.43.216

so if you wanna capture all packets

after selecting the interface and start capturing..

type this in filter

(ip.src==202.101.43.216)||(ip.dst==202.101.43.216)

this will filter all in/out packets from 202.101.43.216 for your viewing pleasure

Please Note: It doesn't alter or change any of the packets..

FSBlackDragun · 04/21/2006, 06:20

Well, thanks to reccaster, Now I have WPE Pro, Im using that instead of etheral...

Seeing how it can be targeted to a specific process, Such as sro_client.exe all I see are the packets that srobot are sending...

So far logging the v1.10 shows 3 different packets, apparently, no packet is sent when the 10 minute DC happens though...

Code:

1 192.168.2.2&#58;4806 202.101.43.216&#58;5228 67 Send 
0000 DC BD 43 00 00 00 00 00 00 00 01 01 00 00 00 00  ..C.............
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0020 00 00 00 00 00 00 01 00 00 00 73 68 61 73 6B 61  ..........shaska
0030 66 75 72 72 79 00 00 00 00 00 00 00 00 00 00 CD  furry...........
0040 EA 7D 61                      .}a

2 202.101.43.216&#58;5228 192.168.2.2&#58;4806 25 Recv 
0000 56 EE 19 00 00 00 00 00 00 00 02 01 02 00 00 00  V...............
0010 00 00 00 00 00 00 00 00 00             .........

3 192.168.2.2&#58;4806 202.101.43.216&#58;5228 16 Send 
0000 00 00 10 00 00 00 00 00 01 00 01 03 00 00 00 00  ................

Those are the only 3 packets I captured at all from the bot running... Apparently the reason the username is sent to the bot server, is so you can get that free 6 hours with new characters...

dragonshiem · 04/21/2006, 14:03

they have a username database.

Leadustin · 04/21/2006, 15:53

Ich schreibe es mal in deutsch. Wenn es nützlich ist, kann es ja mal jemand übersetzen.
Also wenn ich den Bot und Silkroad starte, bemerkt das meine Kerio-Firewall. Ich muss die ausgehende Verbindung bestätigen. Dabei handelt es sich definitiv um SRO und nicht den Bot. der Bot hookt seine Verbindung in der SRO-Prozess und bekommt automatisch seine Freigabe. Wie bekannt ist, haben wir ein Zeitfenster von 10 min um einen gültigen Account einzugeben. Nur wer gibt dieses Zeitfenster vor? Ich denke das steckt irgendwo in der silk.dll Also müsste es möglich sein, per Patch diese 10 min noch oben zuvergrössern und die Verbindung zum bot-Server zu kicken. Es besteht nämlich keine permanente Datenübertragung zum Server.