Reading Ethereal?

[WiLD]

Hi all.
Honustly... iv have no idea on how ethereal works etc.
Im wanting to be able to read the information captured by ethereal, so i know what packets to send/reply to from the server.

I really have no idea where to look for the packet ID (eg; 0x90).

Heres a picture of what ethereal captured in 5seconds.
Im hoping someone will be able to point out where to look for the packet ID and how to tell what it is etc.

http://netblues.org/raven/ethereal.JPG

Thanks in advance.

[shout]

I can tell you that the packet you selected is NOT a battle.net packet.

You click on the packet you want to examine and you click on a portion that says "data" or something of the like. Then you examine the packet all you want.

You will not get WPE-type logs with Ethereal (AFAIK).

The data portion (on a bnet packet) will have:

Code Select Expand


FF [PID] [LOW LENGTH BYTE] [HIGH LENGTH BYTE]


So look for a FF at the very beginning of the data segment, not the TCP headers. The packet id will be right after it.

Battle.net packets are also always to port 6112.

[warz]

Captured packets 1, 2 and 3 are battle.net packets.

[MyndFyre]

You might want to be reading the packets with information denoted "Data" as opposed to control packets.

[WiLD]

I do know that the packets i selected at not Bnet packets.
Im actually wanting packets from something else.
Iv tried to follow what you said but i cant find anything understandable?

Iv included another screenshot of what i clicked etc.
http://www.netblues.org/raven/ethereal2.JPG

[MyndFyre]

The data portion (on a bnet packet) will have:

Code Select Expand


FF [PID] [HIGH LENGTH BYTE] [LOW LENGTH BYTE]


Before answering the question at hand, I wanted to point out that this is wrong (for anyone else who might read this later).  Battle.net encodes integral values larger than a byte in little-endian order, which means the low byte for length is first, and the high byte is second.

I do know that the packets i selected at not Bnet packets.
Im actually wanting packets from something else.
Iv tried to follow what you said but i cant find anything understandable?

Iv included another screenshot of what i clicked etc.
http://www.netblues.org/raven/ethereal2.JPG

What exactly do you want to know?  That part that you have selected is the packet data that the application will process.  You'll need to be more specific if you want to know more.

[shout]

Ooops and thanks MyndFyre!

[dxoigmn]

The data portion (on a bnet packet) will have:

Code Select Expand


FF [PID] [HIGH LENGTH BYTE] [LOW LENGTH BYTE]


Before answering the question at hand, I wanted to point out that this is wrong (for anyone else who might read this later).  Battle.net encodes integral values larger than a byte in little-endian order, which means the low byte for length is first, and the high byte is second.

Just nitpicking but would probably be better to say "high byte is last" instead of "high byte is second." Within context is sounds fine though

[MyndFyre]

The data portion (on a bnet packet) will have:

Code Select Expand


FF [PID] [HIGH LENGTH BYTE] [LOW LENGTH BYTE]


Before answering the question at hand, I wanted to point out that this is wrong (for anyone else who might read this later).  Battle.net encodes integral values larger than a byte in little-endian order, which means the low byte for length is first, and the high byte is second.

Just nitpicking but would probably be better to say "high byte is last" instead of "high byte is second." Within context is sounds fine though

High byte is last in any little-endian context though, no?

[dxoigmn]

High byte is last in any little-endian context though, no?

True, it just sounded weird to me.

[WiLD]

I do know that the packets i selected at not Bnet packets.
Im actually wanting packets from something else.
Iv tried to follow what you said but i cant find anything understandable?

Iv included another screenshot of what i clicked etc.
http://www.netblues.org/raven/ethereal2.JPG

What exactly do you want to know?  That part that you have selected is the packet data that the application will process.  You'll need to be more specific if you want to know more.

I want to know what the packet ID(data, type, number or whatever it is :S) is that iv recieved or sent. For example... where do you get the packet ID "0x25" out of ethereal? Where do you look and what do you do to know that you sent/recieved "0x25"?

Sorry for all this misunderstanding, a said before.... iv never used ethereal nor any other packet logger. I would normally just goto bnet docs if it were to do with bnet, but its to do with another application/game.

[R.a.B.B.i.T]

Do you want to read BNCS packets or not, because you said you didn't.  Not every protocol uses packet ID's.

Blue = 0xff (BNCS packets all begin with this)
Red = 0x?? (This is the ID of the packet)
Green = 0x???? (This is the size of the packet, including the header)

[shout]

A 3174182350ms ping!?

[Banana fanna fo fanna]

You may be interested in "follow TCP stream". It's under one of the menus.

[Adron]

A 3174182350ms ping!?

They use to send GetTickCount() there...