New 0x44 sub packet?

[Sveet]

i was sniffing some packets and caught this one:

Code Select Expand

0000   ff 44 09 00 07 01 00 00 00

bndocs doesn't list a 0x07, does anyone know what it means? my client sent it directly after sending 0x0a

bnet replied:

Code Select Expand

0000   ff 44 1d 00 07 01 00 00 00 01 00 34 0b c1 2b ea
0010   c9 01 fd de 00 00 00 00 00 00 02 19 00


on a very side note: i am tracking packets to madserver.net i have no idea what that is nor any way to stop it. ideas?

[Hdx]

MadServer.net is the new ad system

- Battle.net now uses a new banner ad system.

I believe that's what they are referring to.
If you're worried about it kill these domains:
madserver.net
ad.madserver.net
imp.madserver.net
media.madserver.net
locate.madserver.net

[Maged]

bndocs doesn't list a 0x07, does anyone know what it means? my client sent it directly after sending 0x0a

According to BNalyzer...

[Sveet]

oh cool i was going off http://www.bnetdocs.org/?op=packet&pid=393

and thanks about the madserver thing, i was worried i might have some custom keylogger, cause it only showed up when i went on bnet.

[iCe]

where does one find this BNalyzer??

[Hdx]

If someone can format that properly I'll add her into the BnetDocs specs so this doesn't happen again.
[From the screen shot I don't know the sizes of any of the properties]

Code Select Expand


C->S:
For subcommand 0x07 (Tournament Request):
(DWORD) Cookie

S->C:
For subcommand 0x07 (Tournament Request):
(DWORD) Cookie
(STRING) Status *
(FILETIME) Start/Ending Date
(WORD) Unknown
(WORD) Unknown
(BYTE) Wins
(BYTE) Losses
(BYTE) Draws
(BYTE) Unknown
(BYTE) Unknown
(BYTE) Unknown
(BYTE) Unknown
Anyone mine finding out what the unknowns are?
And the possible other statuses?

[Sveet]

http://realityripple.com/Uploads/Projects/BNalyzer.zip

it works really good, i found it after his post. i dunno why nobody ever mentioned this before XD