Apples & Oranges

[Jesse]

I'm having problems finding information on ShowEQ for windows. I'm curious as to the advantages/disadvantages to using ShowEQ for windows compared with the Linux version.

I also wanted to know, are there risks to using ShowEQ for windows on the same PC running the EQ client? I'm not familiar at all with ShowEQ other then I've seen it run at a friends house. Do you actually need a second account to login with through ShowEQ?

Any help is greatly appreciated. Even if you can just point me in the right direction.

[uRit1u2CBBA=]

The ShowEQ project is linux based, so required a 2nd computer in network with the EQ machine connected via a hub (as opposed to a switch) so it can sniff the packets to and from the EQ servers.

The MySEQ project is a seperate project and is windows based (can search for home page, I don't know what it is) that can run on the same machine as EQ, or can run on a network on a 2nd windows machine by having "MySEQ client" software installed on the EQ box, and then it connects to the "MySEQ server" so it can have information passed.

Which one is better, that's for you to decide

[Jesse]

So ShowEQ doesn't acutally connect to the SOE servers at all then? It just sniffs the packets going through my network?

[Freakyuno]

So ShowEQ doesn't acutally connect to the SOE servers at all then? It just sniffs the packets going through my network?

An expanded information program that connected directly to the EQ servers wouldn't be around long enough to post about it.

[purple]

ShowEQ is 100% passive. It gets all its in-game information from packet sniffing the connection between the eq client and zone/world servers (well and from you copying in eqstr_us.txt and spells_us.txt).

MySEQ and ShowEQ are totally separate projects.

[uRit1u2CBBA=]

MySEQ doesn't connect to EQ servers either -- it gets it's information by peeking at memory that EQ client has initialized and populated.

[elf]

And, in getting data out of memory of the EQ client machine, MySEQ does stand a greater chance of being detected. Calling a windows function that would throw exceptions if the memory was read by another process would not count as scanning memory for a process, and Sony could possibly get away with it in the near future.

On the otherhand, passive sniffing of the data is detectable only in theory, if I remember the things i have read. Something about the latency that pcap introduces.

Okay, it's obvious I've been out of the scene too long. Back to work.

[purple]

No, seriously, seq is 100% passive.

pcap doesn't touch any part of the stream between the world/zone servers and the eq client. It just gets a copy of the packets because hubs distribute all packets to all ports and let it get sorted out by the hosts.

pcap could be the largest crappiest piece of shit ever and it wouldn't cause latency between your eq client machine and the world/zone server because it has absolutely nothing to do with that, other than consuming copies of packets the hub makes available.

[elf]

Not what I meant, Purple. There was a discussion going around once, I don't remember which boards I read it on, that if you knew the network topology and the devices IP addresses, you could selectivly scan the network and detect which devices had their interface in passive mode. I never heard of any tools being built to run automated scans of a network for this, hence why it's only in theory. And then with most people running NAT devices now days, it quietly disappeared. The idea was that the devices should have a fairly similer ping latency to the nearest router, given similer bandwidth and usage, but a device with pcap enabled had to filter the data through instead of replying to a simple ping. Thus a sudden jump in latency without an increase in throughput could be used by the ISP to determine that the device was passivly sniffing packets.

It would be impossible to use this to prove the use of ShowEQ though, I agree.

[BlueAdept]

The thread was about detecting ethernet cards in Permissive mode. It is possible to detect computers on your network that are in permissive mode, but it does not mean that you are running ShowEQ and Sony could not ban you for having a card in permissive mode.

[purple]

Promiscuous mode, not passive mode or permissive mode!