First time user having problems

[cousinscuzzy]

I just heard about ShowEQ and set it up last night on a Redhat 7.2 system. Compiling and installing it was easy with the great instructions that are in these forums. I'm able to run it without any trouble, but it doesn't seem to be working right.

Here's what IS working... I'm able to get a map automatically for the zone I'm in once in a while. Occasionally the map comes up after a few minutes, other times it seems to appear only when I'm zoning OUT of that zone. When I cast a spell a timer usually does appear for it and it begins to count down. ...That's about it.

Nothing else is working at all. I've yet to see a mob of any kind either on the map or in a list. On the rare occasions that I do get a map of the zone I'm in, it's usually static and doesn't show my character's movement. Only once or twice have I been able to actually watch myself moving through a zone on the ShowEQ map, and I think those were both times that I manually selected the map from the File menu. My character's level, class, and race have never been detected. None of the information about skill levels, HP, or mana is showing up. Worst of all, the windows seem to be completely frozen much of the time. Running "top" shows that X is eating up 95-97% of the CPU (unless it's the memory--I can't remember; heheh) but this ONLY happens when I'm running ShowEQ.

As I'm brand new to this I don't have much idea whether this should be working better or not. I know that you have to wait for ShowEQ to break EQ's encryption when you zone, but it doesn't EVER seem to get there for me. I've tried creating pets, waiting for spawns, etc. ...I've waited for up to an hour. Is there something I need to update? Did Verant's last patch break ShowEQ? I desperately want to use this great (sounding) program! Anybody have any words of advice for me?

[high_jeeves]

It sounds like you probably have network issues... check the forums for networking threads.. most noticably.. make sure that your network is setup in such a way that the SEQ box can reliably sniff network traffic, and that you are not using any sort of PPOE/VPN software...

--Jeeves

[cousinscuzzy]

Thanks for the quick reply, Jeeves.

I think I'm using a 10/100Mbps NIC on my EQ Client PC and a 10Mbps NIC on the Linux box. It may be that the 10Mpbs card on the Linux box is trying to read Ethernet packets that are passing by at 100Mbps. I'll have to check into that... Tcpdump works (sort of) but there seems to be long delays where network traffic isn't reported. I'll try setting my EQ Client's NIC to 10Mbps and see if things get better.

Cousinscuzzy

[DrLinux]

You can't sniff 100mbit traffic with a 10mbit card on a 10/100mbit hub. I think 10/100 hubs use two separate...erm..."layers" internally, and thus you might not see all the traffic.

I could be wrong tho...but from my experience I try not to mix 10mbit boxen and 100mbit boxen on the same hub, esp when you can get a cheap 10/100 PCI eepro card for around $30. laptop cards are, of course, more expensive...

[high_jeeves]

You are right DrLinux... the 10Mbit plane cannot sniff traffic off the 100Mbit plane (and vice-versa).. try upgrading the 10Mbit card to a 100Mbit card, and you should be good...

--Jeeves

[lane]

Those cheap 10/100 things use a switch interface between the 10mbps side and the 100mbps side. Liek said before, just switch one of them and you should be fine.

Interesting that you ocasionally get some information. Only thing I can think of is your switch sucks and is forwarding some packets to the wrong port. It may be that it doesn't know the MAC address of the destination so it is flooding it.

-Lane

[S_B_R]

don't forget about good'ole PPPoE... It can cause very strange things to happen... I dunno if it's being used here but it's something to look into....

[cousinscuzzy]

Well, I think I've eliminated any network problems. Both NICs are operating at 10Mbps, and tcpdump on the Linux box shows all packets to/from my EQ Client. I'm using a cable modem and a LinkSys router for my Internet access, no PPPoE involved. ShowEQ's packet counter has logged thousands of packets coming across, and every time I cast a spell it does show up and start a timer. (It shows the caster and target both as "N/A".)

Still I rarely get a map to appear, and I've yet to see any mobs show up. Are there some configuration settings I need to modify? The only ones I changed were for the interface on the Linux box and the IP address of the EQ Client.

I'm still having the problem with X eating up my processor time but the workaround that others have mentioned of toggling "View - Map" off and on seems to fix that.

Oh, one thing I might try... I do have VPN software installed on my EQ Client system that I use to work from home. I would hope that it's not interfering with my regular network activities when it's not in use, but I realize that VPN software does a good job of tangling up the TCP/IP stack. I may uninstall that temporarily to see if the problems clear up.

Cousinscuzzy

[high_jeeves]

If you are getting packets, but not everything is showing up, there are a few possibilites:

1) You are only getting packets in one direction (to client, or from client).. check tcpdump to make sure you get both
2) Your VPN software is infact screwing with your packet structure... (unlikey..)
3) Your install is bad.. you either dont have a good libEQ, or you are running an old version of ShowEQ
4) Your network has very high traffic, so the kernel is dropping lots of the "sniffed" packets

--Jeeves

[drkavngr]

My map only comes up after I reboot the computer that I am sniffing. Does SEQ cache info that gets flushed out when I reboot the PC that it is sniffing?

[cousinscuzzy]

It seems that SEQ is only seeing packets in one direction after all. When I ping the Linux box from my EQ client box, tcpdump can see both the echo requests and replies. However, when I ping an external system (on the Internet) from my EQ client box, tcpdump only picks up the outgoing echo requests and never sees the replies. Same thing with DNS queries, web page requests, etc. My EQ client box does get replies, the Linux box just isn't seeing them for some reason.

I'm thinking maybe I need to replace the NIC. The one I'm using is pretty old and maybe promiscuous mode just doesn't work properly in Linux with it. I think it's a 3Com 3c900--it's only 10Mbps and it has a coaxial connector along with the RJ45. Any other ideas?

Cousinscuzzy

[S_B_R]

I'm thinking maybe I need to replace the NIC. The one I'm using is pretty old and maybe promiscuous mode just doesn't work properly in Linux with it. I think it's a 3Com 3c900--it's only 10Mbps and it has a coaxial connector along with the RJ45. Any other ideas?I'd suspect the "hub" before the NIC...



My map only comes up after I reboot the computer that I am sniffing. Does SEQ cache info that gets flushed out when I reboot the PC that it is sniffing? Nope SEQ doesn't care one way or another if you reboot the client machine... You maybe getting a new IP address when you reboot your computer, that would be the only thing that could effect SEQ...

[drkavngr]

Nope I get the same ip everytime I reboot. It seems to work whenever I get a new libpcap filter, which only happens after my client reboots. It's like seq is saveing some filter settings somewhere.

(with out reboot)

Useing config file '/usr/local/share/showeq/showeq.conf'
Loading filters from '/usr/local/share/filters.conf'
Listening for 1st client seen.
Initializing Packet Capture Thread:
Filtering packets on device eth0, searching for EQ client...
Opcode Loging Mask: 0 0 0
Categories Reloaded


The I get nothing. When I reboot the client its like it can see it because I get a diffrent message talking about creating a nre pcap thread for port x and x and x etc.

[cousinscuzzy]

Well, thanks to those who gave advice. It appears that the 5-port Linksys "hub" I'm trying to use is in fact a switch. This, despite the fact that it's labeled and sold as a hub. I'm going to return it if I can. Beware of model EFAH05W, in case you're looking for a new hub.

Just curious, anyone else out there had trouble with this model? Have any recommendations for a good, inexpensive hub that actually broadcasts traffic on all ports?

Cousinscuzzy

[Dedpoet]

Most Linksys "hubs" are switches. I used to use a Netgear DS104 with no problems and have seen other people say those work. I currently use a D-Link DSH-5 because it's 100MBit and it also works great. Try to search for the word "switch" or "model" and see what other people say works.

Edit: heh, I searched on "linksys" and there are 3 pages of hits. I just find that funny, sorry :-P

[S_B_R]

Originally posted by drkavngr
Listening for 1st client seen. I betting you'll have better luck if you explicitly define your client IP. Try running SEQ using the following commandline:
/usr/local/bin/showeq --ip-address=xxx.xxx.xxx.xxxWhere xxx.xxx.xxx.xxx is the IP address of your client machine

[cousinscuzzy]

I bought a Netgear hub today and it works great! Grrrr.... I've suddenly become very anti-Linksys.

BTW, this program is bad ass! Thanks for all the hard work that has gone into it.

Cousinscuzzy