Showeq = safe

[Smog]

Well, I know everyone has said time and time again that showeq is safe. But I just wanted to add my experiance to the pile.

I was in South Karana a while back and someone had gotton bugged and couldn't log back in. Their friend petitioned and a Guid showed up. Well, the guide brought another guide because he was a guide in training. They couldn't fix it so they brought a GM. The GM tried a few things and then called a "higher level" GM or something.

Mean while I was running around killing every mob in the zone to try and get Quillmane to pop. I decided that even if it did pop I couldn't run strait to it anyway for fear of the GMs so I decided to check out the GMs.

I ran over and chit chatted with them for an hour or so untill they got the problem fixed.

The moral of the story is: I was standing 5 feet away from 2 GMs and 2 Guides for over an hour and they had no clue that I was using ShowEq. I later realized that I had run strait to the GMs (I only knew their loc because of SEQ) and that didnt even tip em' off!

To tell you the truth, the program doesnt give you the huge advantage that people think it does. It just removes some of the more anoying parts of everquest. (getting lost, losing your body, runing right into a level 60 mob... etc.)

[raalee]

Attention:

There is absolutely no way for soe to tell if you are reading packets off the wire.

[RSB]

To be honest the GMs would have to be watching for suspicious behaivor first. If they are trying to fix something I don't think they'd be monitoring for this behaivor.

How you could get caught is something like.
Constantly killing rare wandering mobs with others in zone hunting the same thing (and not being a tracker)
The other people in the zone /petition ing about your behaivor.
GM investigating and obsurving your unusual behaivor.

That or just Shouting the zone "I'm Camping Quill and I'm using ShowEQ so stay away"

RSB

[Alwayslost]

Maybe Mr Suspicious is rubbing off on me, or maybe I'm just naturally paranoid. But I adopted the following practices:

1) When possible, I'm grouped with a tracker while hunting mobs and I never Bee-Line to the mob.

**This is where my paranoia comes in**
2) I NEVER, EVER, EVER use terms that can be associated to SEQ (seq, showEQ, Filters, CVS, etc.) If talking with another SEQ user I brake up the word with spaces, like "fil Ter"

It really isn't that hard for The Man to set up a machine that ONLY scans conversations and throws up flags on key words... Then tosses that flag onto the account that used it. Then, *IF* an EQCS is -already- investigating you for some reason, they see the flag and pay a little more attention to your behaviors.


Just my .02

[casey]

2) I NEVER, EVER, EVER use terms that can be associated to SEQ (seq, showEQ, Filters, CVS, etc.) If talking with another SEQ user I brake up the word with spaces, like "fil Ter"

if you are afraid to say CVS because of showeq, you might want to also take another look at using words like "computer" and "software". CVS is not an uncommon thing, nor something that anyone but the paranoid-never-used-CVS-only-uses-linux-for-showeq types are going to get a red light over.

[Mr Guy]

I follow the same beliefs on paranoia. You aren't paranoid if they really are out to get you.

I'd add 3) Never ever ever take credit for doing something amazing. Repeat after me:
"Cool! I didn't even SEE him there, I got aroed."

"Wow! I had no idea that was a PH! I was just clearing the area!"

"Man how did you do that? What? I pulled him? I thought you pulled him! lol"

(When en route directly to your group across the zone) "What's your loc again?" (repeat, turning slightly each time)

[Alwayslost]

:p

I never saw CVS before I started playing with Linux... Ok, I'm a noob. Regardless of my noobish paranoia on anything that can be associated with ShowEQ, even CVS which is COMPLETELY alien to 95%+ of the EQ players -could- be a trigger to a flag.

Remember I did not suggest that triggering the flag was an automitic attention getter ensuring immediate GM focus... I have zero grounds for that assumption. All I said was it would be easy for them to set up a flag system based on words you type in chat. I merely suggested that this was EASILY accomplished and something that I myself would have set up long ago were I in their shoes.

Because 95%(+) of the EQ players have no idea what grep is, anyone that make any reference to Unix or Linux is potentially suspect in the eyes of VI. So yes, I will still refrain from using CVS, Linux, or any other word -I- associate with ShowEQ.


LOL, Deny Deny Deny... ;)


Yesterday as I was running through a zone someone was asking for help locating a corpse, I got the name of the corpse and told him, "Look in the area of nX,pX"

A few minutes later he tells me how did you do that? I said "You got lucky, I had just run by it and was guessing as to the location... how close was I?" :D

[RSB]

Many people have not heard of Grep & CVS because they are not IT Geeks. But many of us are. 8)
I'd spit the dummy if I got banned from EQ because I was talking about a source control program.

True they can monitor what you say but I have a feeling they only turn that feature on for people/groups under investigation. Think about how much spam there is out there by people talking
/auc /shout /tell /gsay /gu now channels - thats a fair bit of data to collect of very little benifit.

[Dedpoet]

I used to run and code for a text based mud back in the day (remember those?!), and although it's obviously different, EQ has its roots there. They already parse everything you say on channels through their "talk" code which contains, just off the top of my head, the swear word filter. So they take every text line, do a string compare to a list of swear words, replace those words with other characters, then pass the changed string to the clients(at least that's how a mud would do it...I'm no MMPORPG coder).

It would be ridiculously easy to also string compare for words like "seq", "showeq", "sourceforge", etc. and direct them to a file and it wouldn't add much overhead.

I agree with RSB and casey though, that words like "grep" and "CVS" are not incriminating, but I think we all know better than to say "seq" or "showeq." The guy I normally duo with also runs seq and we will say things like, "Is mob X up?" or, "pull the level 35 one." Nothing more specific than that. I was actually grouped with a guy once that was talking about percent experience, like he had 94% of his level...gee, I wonder if he's a user.

[EQDoze]

The badword filter is in the client...

If you use ShowEQ for channels, you'd see this. ;)

[Dedpoet]

That's what I get for speaking on something I didn't look into. I deserved it!

[RSB]

I talk formulas in game all the time. One time a mage friend was wondering why he was getting 1/2 the xp as normal. Thinking that when I joined him we'd easily beat the pet's dmg (which we were) I looked at my numbers did some calculations ask him to take some SS and send them to me and he was getting the xp we'd expect for 2 people. Turns out that soloing with his pet he was getting in more dmg then the pet but was doing less than 1/2 the total dmg to the mob. Turns out mobs where doing more dmg on the DS then the pet was doing to them. Thus we've figured out that the pets DS does not apply in the calculation on how much dmg the pet does. So on very fast hitting mobs the pets DS out dmg the pet and the mage gets full xp 8). If they went to change this it would effect PL alot as right now if you DS someone and they do no dmg to a mob (all dmg being done by the DS) then the mob poofs and no xp is gain.

I'm not that paranoid :)

[JackOfAll]

Anyone who's used SEQ (GM's have the equivalent) can see right through it if you're not careful. For instance, I zoned into Kurn's tower right after I got SEQ working to see if the Jester was up. (thought I was being sneaky) What do I see...a 52 SK sitting in a corner. A minute later, one of the special mobs spawns and the SK makes a beeline for it halfway across the zone. Anyone who's been in Kurns knows it's a maze of rooms and hallways and it would be impossible to locate a mob unless you just ran across it. The SK did this a few times and I was tempted to send him a tell...then again he could be a spy ;)

The best thing to do if you see a rare spawn is check and see if anyone else will get it first and if not, then take your time and make it look like you randomly bumped into it.

[cbreaker]

I really don't think it's anything to worry about, SEQ.

They can't tell if you are sniffing packets. It's a passive activity.

You would have to be real dumb to "get caught" using it. Even if you run straight for mobs, tell your groups what is camped in the zone or not without a camp check, and say what level a mob is, all this information could have been had from elsewhere.

No GM is going to kick you off, because they won't know. And I really believe that the percentage of people that use it is low.

It's not like Xylobot, where you can get afk exp.

[showeqnewb]

I dont care if it is flagged or not. I never use anything associated to SEQ. If I am talking to someone about SEQ, I am on my SEQ machine on AIM. Linux = Netscape = AIM

[liquidx]

You all sound like my boyfriend, he's one paranoid freak

Well first of all they *could* have a few different ways to catch ShowEQ users.. here's how I would do it..

Build in small chat filters to catch users who say "Showeq" "filter" "seq" etc, do nothing but incriment a counter for this in the player's profile each time..
Next, Check if any machine on their network local to the EQ machine is in permisc mode.. Simple add a flag to their account again
Next, Find out the standard deviation on a course while in a zone, I imagine this could be too difficult because of all the math involved, and the number of players.. Anywhoo, just add another flag..
And last, have a few items that are EXTREMELY hard to see over the zone, and count how many times a player has picked one up, again, just add a flag.


Now, if you have all of thoes flags, or multiple ones at least, they should start an investigation..

A GM should zone in sometime while your camping something, or basically just staying in zone, and try a few things, such as, moving you to the safe point, and checking how direct of a path you take back, dropping an uber item on the ground (or possibly something named uber, but not really uber), maybe make an uber uber rare spawn in the zone, something that most people would have in their filters, such as Quillamane, and see if the player darts away from his camp..

Anywhoo, NONE of this is SOLID evidence that your using showeq, but verent doesn't NEED solid evidence. I think this is about the only way they could find you running it.. unless your stupid enough to run it on the same machine as EQ.

Verent are rule nazis, thousands upon thousands of rules, I wouldn't be surprised if they started kicking people just for having a computer in permiscuous(sp?) mode, which would mean I'd be banned even without running showeq =P

[liquidx]

Originally posted by cbreaker
They can't tell if you are sniffing packets. It's a passive activity.


Auctually, your ethernet card either needs to be set into permiscuous mode to read the broadcast data.. However, ShowEQ is only one of thousands of programs which do this... Its also the only reason (that I know of) that ShowEQ requires root..

Other machines on a local network assuming hubbed or redirected broadcast data can tell which are in permisc mode on the network.

[bonkersbobcat]

There are methods to find out if another machine on your local wire is operating in promiscous mode.

It turns out that the response speed of a network card to various packets changes depending on if the card is in promiscous mode or not.

l0pht (now @stake) used to have a tool that used this technique.

[RavenCT]

Now, I wonder what kind of legal bruhaha Veriant would be opening if THEY started "sniffing" the local LAN to find out what other cards/machines/etc are on the segment...

If I remember correctly, there was a huge uproar when it was found out that they were analyzing what processes (apps) were running on the Windows box that EQ was running on and sent that information back to themselves... if I remember correctly there were a LOT of people who were very upset with that.

Also, that opens up all kinds of privacy issues too, but they could always stick something in that mile long disclaimer of there's...

[Cryonic]

They had that hidden in their disclaimer also, still doesn't make it legal. Also it isn't practical to do that. In my case, my network is a Class B subnet. VI would have a very hard time proving to me and the company I work for that they are in their rights to hit my network checking everyone of those IPs for a card that is in Promisc mode and also proving that meant it was running SEQ.

There are a number of reasons that a NIC would be in promisc mode and SEQ is the least likely of them in a network of that size.

[high_jeeves]

Plus, as long as the ShowEQ user count stays relatively low, why would they spend the thousands of dollars on design, development, and testing of these counter measures? It just isnt worth it for them.. that is why, as long as ShowEQ doesnt become a tool that is available to anyone, it wont be a problem. It just doesnt make business sense for them to spend alot of time dealing with the relatively few people who use the tool..

--Jeeves

[liquidx]

Originally posted by Cryonic
They had that hidden in their disclaimer also, still doesn't make it legal. Also it isn't practical to do that. In my case, my network is a Class B subnet.


Clicking "I agree" to a contract is not the same as signing a contract, no matter what they would like you to believe.
It simply makes it easier to "Instill Doubt" on their customers, theres no law against making contracts like that.. but if you chose to fight it in court, you would pry win. This doesn't mean they cant cut your service off at any time they want for any reason whatsoever.



VI would have a very hard time proving to me and the company I work for that they are in their rights to hit my network checking everyone of those IPs for a card that is in Promisc mode and also proving that meant it was running SEQ.


No they wouldn't, they would simply say "Its in the contract, read it, dont like it? dont use our software."

Of course they would never do this, its just common sense, BUT, look at it tthis way, if there are NO machines on your network in permisc mode, you couldn't be running showeq, could you? Maybe if you got it working stand-alone in windows..
I simply meant IF a machine on the LAN is in permisc mode, add a flag, nothing definant, nothing even worth investigation of course, just, if you have other flags against you, check for permisc modes.
Also, checking if a NIC is in permisc mode is less obtrucive then a passive tcp scan, as it scans the MAC addresses on the broadcast.. not IPs on the network.



There are a number of reasons that a NIC would be in promisc mode and SEQ is the least likely of them in a network of that size.


Of course, 5 out of 7 of my linux machines here at home are in permisc mode for some reason or another, only 2 of which run ShowEQ.

[liquidx]

Originally posted by high_jeeves
as long as the ShowEQ user count stays relatively low, why would they spend the thousands of dollars on design, development, and testing of these counter measures?


Exactly, and even if it did become a fully-blown cheating program, they would have to factor weither the users that leave because of ShowEQ would be worth creating the countermeasures, and if the countermeasures would make people leave (cause they always screw one thing up when they fix another, they even plan for it).

I dont think VI has any real tracking systems and shit like they would have us believe, infact, I'd bet 99% of people that got caught running xylobot/showeq and stuff like that prolly told their friends, which got jealous(or angry) and told a GM.

[fryfrog]

i think the best they can really ever hope for is to not send so much fucking useless information to the client. i mean, in a zone like dreadlands the client has knowladge of mobs that are a 10min real life run. there is no reason for them to send THAT much data.

i have to applaud daoc on that aspect. you still had a showdaoc program, but it was MUCH less useful because you could only see a small sphere around you... so no rare hunting :)

[RSB]

Ummm if I'm not mistaken you can have your linux box set up to be in promisc mode but not detectable on the network via cabling.

I've seen a demonstration where a guy bled off a signal from a fiber cable without the Routers actually detecting a degrigation of signal strength. Its not rocket science.

That and I say let the paranoid people stay paranoid....doesn't hurt me.

[liquidx]

Originally posted by fryfrog
i think the best they can really ever hope for is to not send so much fucking useless information to the client. i mean, in a zone like dreadlands the client has knowladge of mobs that are a 10min real life run. there is no reason for them to send THAT much data.


I can only think of one reason, tracking.. The information showeq displays isn't always accurate, if you've ever tracked players down alot, I'm sure you've noticed that it leads you to places where they used to be awhile ago sometimes.. I've noticed this is also where showeq says they are..

But I'm no expert

[fryfrog]

yeah, the only valid reason to send all the data i can think of is trackers. there are two solutions to that... only send all the data to chars that have track or remove tracking.

and the player tracking is funny isn't it? just fyi, players in your group are ALWAYS update. players NOT in your group you get an initial location when you zone in and if they come into a certain range around you. so if you need to find someone either group with them or zone out/in and tell them to hold the heck still.

[LordCrush]

I have no knowledge of the EQ-protocol or the internals, but playing a Ranger a long time. I can subscribe to it, sometimes you have no chance to find a player with track in a zone - it drives you crazy.

- Lord Crush

[RSB]

I point you to
http://seq.sourceforge.net/showthread.php?s=&threadid=1172&perpage=1&pagenumber=9
where I describe why things are done.

Why are player tracking and locations off in SEQ and in game?
Thats easy. Location data for mobs is guessed by the client. Since mobs often just walk in a straigh line for long distances the server sends minimal number of location updates for the mobs during the walk. When the mob changes direction the information is sent to the client. With players the server would be constantly sending updates to the client so they throttle that back to an initial position or if they are within a given radius.