Help please.. and I am not stupid.. :(

[septara]

I have spent the last 12 hours playing with this and its not working for me heh.

I am on redhat 7.2.. everything compiles fine.. I can see the data passing using tcpdump.. and the ip's are correct.

When I turn on showeq.. it just sits and says unknown in all blanks.. ie: its not getting any data.

Can someone help me before I jump off a bridge *LAFF*.

- Sara

:ADDED INFO:

The packet count is not moving at all. I am using a 10mb netgear hub... and I really can see everything in tcpdump.

I am using the right interface.

ADDED 2:

The internet connection is PPPoe ADSL. just in case anyone can think of a reason why this would matter.

[RavenCT]

First off, with your Internet connection, is it connecting directly to the PC? i.e.

Internet ---- PC (EQ box) ---- Linux (SEQ Box)

If so that's NOT going to work. You need some sort of device to put the packets on the local network. If your DSL connection is going directly to you PC, get yourself a Linksys router and connect the DSL connection to that, hook the Hub off that, and connect both PC's from there...

Either that or connect the DSL connection to the Linux box and turn it into the router. Otherwise the packets are NEVER going to get to the local LAN

Internet
|
Linux(SEQ)
|
PC(EQ)

or

Internet
|
Linksys Router
|
Hub
|-------------\
Linux (SEQ) PC (EQ)


There are LOT'S of messages on the boards about this, I suggest you learn to use the SEARCH feature quickly... Otherwise expect the flames to come rolling in!

(Yes, I spoiled another one :0 )

[septara]

That is not the setup

I have an internet router.

INET > ROUTER > HUB > PC1
PC2 etc

The packets ARE getting to the linux box as I noted.

tcpdump sees everything.

SHOWEQ is not seeing them so I think its a problem with showeq and not the net.

I know how to search.. nobody else had this problem.

-S

[RavenCT]

Edit your showeq.conf file and make sure that it's looking for packets at the IP address of your EQ box? Try hard setting that instead of using the auto-detect? (i.e. 127.0.0.1)

If the packets are getting there and SEQ can't see them, well, then you have me stumped there... Try setting the IP though, maybe it's not detecting the other IP correctly

[septara]

Yah.. already tried setting the IP directly.. and also tried the MAC addy for fun.. neither are working :(

Sucks to be me ;)

[fyodorst]

I know this may be a bit patronizing but...

when you say tcpdump sees everything are you sure its seq traffic and not other traffic (like some 1337 h4x0r on the doze box, hehe)?

also when you say seq is unknown in all blanks, what do you mean? is it just not decoding or is it just all blank... i assume you are running it from a terminal, what is the output from there?

[septara]

Yes.. its traffic from the eq servers.. eqzoneXXX.blah989studeos.com to my eq box.

When I say blank.. it says unknown in all fields.. the map is blank and packets are 0 and not moving.

-S

[fyodorst]

hmmm... first thing i would try is to get another packet sniffing program and install it... see if you can actually read all the data in the packets...

from there i would yield the floor to devs

[septara]

Well it was my understanding that the reason we need libEQ.a was that the data is encrypted. In that case I would see nothing but gibberish in the packets anyway.

But I will see if I can at least see that.. worth a try.

-S

[fyodorst]

which is why you should see if the kernel is able to actually read packets by using some other sniffer

[septara]

Anyone have any ideas on how exactly to do this? I am not exaclty a linux guru heh..

Any suggested packages or test plans?

[septara]

MORE information.

I managed to insatall a package called "Ethereal" that should allow me to filter.. and low and behold I am not seeing the EQ traffic in it either..

Anyone have a clue why I would see packets in tcpdump but not in either sniffer?

I think all this information is leading someplace.. I just dont know enough to say where :)

[Cryonic]

Wonder if the NIC in the linux box is able to actually go into promiscuous mode (some aren't). Try changing out the card.

[S_B_R]

Originally posted by septara
That is not the setup

I have an internet router.

INET > ROUTER > HUB > PC1
PC2 etc


Where is your PPPoE software running? on the Router? or the Windows PC? If it's on the Windows PC, PPPoE is not exactly ethernet. I would suspect that's why you can See packets moving on the network but you can't see what's in the packets, because of the PPPoE wrapper.

[septara]

Aye.. the pppoe is on the windows box... and most likely the pppoe is interfering.

I will have to look and see if anyone out there has a work around to seeing into pppoe. :(

[IgorQ]

My Linksys DSL router alows me to use it for PPPoE authentication. PPPoE goes in the router from the DSL hardware then gets sent out to my network as ethernet. Some other routers alow you to set them up for PPPoE access.. dont know the names. had this Linksys for about 2.5 years now and is marv.

[septara]

Thanks. I think my other option other than going out and buying a new DSL router is to use the linux box as a router.. heh

Let the fun times roll ;)

[BlueAdept]

Just a quick question.

What version does SEQ say?

A lot of people have problems because they got the old verison from the cvs and not the 4.xx one.

That would also make everything show up as unknown.

[fyodorst]

make sure u get a good firewall built if yer gonna do that. and turn off all those pesky daemons that eat up ram and run by default on distros like red hat...

[septara]

Heh.

I also did get the version I got from CVS.

If that is not the right place.. where should I get it?

Thx. ;)

-S

This is what I use to pull the version I have:

cd /root
cvs -d:pserver:[email protected]:/cvsroot/seq login
cvs -z3 -d:pserver:[email protected]:/cvsroot/seq co showeq
cd /root/showeq
cvs update -P
cvs -d :pserver:[email protected]:/cvsroot/seq logout

[septara]

setting linux up as a router fixed it all.. the ppoe was getting in the way.

Thx all.

[fryfrog]

well, you have fixed it... but pppoe changes packet structure. it puts new umm... well, packet things (i forget the real words at this point in time) so they packets are actually different. i'm surprized that your hardware router did not have an option to use pppoe, as most current ones do.

[cyrus2kg]

Since everyone seems baffled, i have to ask, did you remember to run EQ on your windows box??

[high_jeeves]

Ummm.. you reading the same thread as the rest of us cyrus2kg? This problem is already solved, it was PPOE (which, as fryfrog said, adds additional headers to the packet with ShowEQ doesnt look for)....

Thank you, drive through...


--Jeeves

[fyodorst]

wtg septara

[S_B_R]

Originally posted by high_jeeves
Ummm.. you reading the same thread as the rest of us cyrus2kg? This problem is already solved, it was PPOE (which, as fryfrog said, adds additional headers to the packet with ShowEQ doesnt look for)....

Thank you, drive through...


--Jeeves

Oh come on! Don't I get any credit? /cry

;)

[NobodyImportant]

Originally posted by S_B_R


Oh come on! Don't I get any credit? /cry

;)

You are the man. Your post opened the door and the rest just walked in. /bow

seriously though, nice troubleshooting work.