I have 3 PCs being sniffed but one will not decrypt...

[Sneaky]

I did a search but could find nothing like this...it is strange. I have 3 PCs running into a hub, my SHOWEQ machine sniffing them all, running 3 different desktops. 2 of the 3 decode with little or no trouble. The 3rd (actually my main PC) rarely decodes and when it does it doesn't fully decode every spawn. I have tried about everything i know to do. i have NOT replaced the network card, but then it works...why would I...anyone ever see this before or have simular symptoms?

My IP addresses are
192.168.1.100 (decode problem)
192.168.1.103 no problem
192.168.1.104 no problem

NOW the only thing I do differntly when I start SEQ is when I start on the default machine (the one with the problem) all I do is type showeq at the terminal prompt and the program starts. the other 2 I have written small executable scripts for..

showeq --ip-address 192.168.1.103 (or 104)

I have named the scripts SEQ1 and SEQ2 so all I have to type is sh seq1 9or seq2) to make the other 2 run...

It just seems strange...

[S_B_R]

have you tried running the non-decoding one like the others?

showeq --ip-address 192.168.1.100Have you looked in your showeq.conf to makesure there aren't any syntax errors?

Is the correct IP addressed assigned in the conf file? i.e. 192.168.1.100 Or are you relaying on the autodetect feature?

What is the datarate set to on the non-decoding PC? is it different from the others?

You might consider posting your showeq.conf file...

[fee]

try using the propper form of the command line options, e.g. --ip-address=192.168.1.100

Thats probably not the problem though. I would bet the problem is lack of "horse power" on the ethernet card itself OR the CPU/RAM. Running 3 instances of showeq can put a strain on the systems resources.

Get a good NIC like a 3com or Tulip based card.

fee

[Sneaky]

I can't see how any of the software could cause this issue since I can run it sniffing the other 2 PCs fine. If I only run 1 SEQ session on this machine it still does the same thing. I will try a new NIC...

[high_jeeves]

I recently tried to redo my network and browse multiple (2) ShowEQ sessions off a machine in another room using VNC. What I discovered is that since VNC was generating a significant amount of traffic, ShowEQ (actually, the network card itself) would not be able to process all of the packets on the ether (instead, it would prefer packets to and from itself, and drop "other" packets which it wasnt ready to handle). What I would get about 5% effective packet loss on this sniffing.

What does this mean? Well, most of the time, showeq worked fine, decoded fine... but, if one of those packets dropped was part of the zone in information, or the player information, I would end up with a borked decode. Its possible that if your network card or CPU isnt handled the packets fast enough (at the kernel or libpcap level), they are getting dropped. As to why this would happen for one machine and not others, it could be freakish luck..

A few questions:

1) How often does it happen?
2) How many times have you tried it?
3) Have you tried running ONLY the machine that doesnt decode?

--Jeeves

[fryfrog]

i think he said if he runs it for ONLY that one machine, it still doesn't decode. are you ACTUALLY seeing traffic from this machine? is it on a different hub from all the rest? have you put a new nic in IT?

i sort of get the feeling that it could be something with that ONE machine and not with seq. or perhaps something between it. i have seen posts here where people would get very partial decodes, only to find that replacing the nic in the linux box or windows box fixed it, or replacing the hub in some cases. all i can offer is general trouble shooting tips.

try to eliminate one thing at a time. grab the nic from a working windows computer, put it in the broken one. if that doesn't fix it... it ain't the nic. plug the broken one into the same network plug on the hub as your working eq machine. if that don't fix it, it prolly ain't the hub. just keep eliminating things one at a time. replace the linux box's nic, wiggle your toes...

[high_jeeves]

Another thought... are all the machines running at the same network speed? (All 100MBit or a all 10MBit)

If showEQ and 2 of the machines are running at 100MBit and the other machine is at 10Mbit (or vice-verse), that could cause a problem like this.

--Jeeves

[S_B_R]

Hey fryfrog, you reminded me of and incident I had with 2 identical Linksys cards. I had one in my computer and one in my wife's computer. We both could transmit and receive to and from the Linux box (which had a 3com card in it), But we couldn't transmit or receive anything higher in the TCP/IPs than a ping between her's and mine. Pings worked fine, but nothing else (FTP, SMB, HTTP, and etc) wouldn't work.

So how I fixed it was, I replaced the 2 3Com NICs in my Linux box with the 2 Linksys cards, and put the 3Com NICs in our PC's. after that everything worked fine...

The Linksys card still won't talk to each other but one has the internet IP and one has my Intranet IP so they never need to talk to each other. =)