Unable to get showeq working / processing traffic

[jars75]

While tech savvy, I am new to ShowEQ; this is my first time attempting to set it up. So far, I'm unable to see any actual activity in the GUI. No spawns, map loading/movement, etc.


My EQ machine is a Win10 Desktop. My SEQ machine is a Laptop that I installed Linux Mint 21.3 Xfce. I have a GS305E Netgear switch with 3 connections: ethernet from router, ethernet to laptop (port 2), and ethernet to desktop (port 3). I have it configured to mirror traffic from my eq desktop (3) to showeq laptop (2).


On the laptop, I have SEQ 6.3.10 installed (GCC 11.4, glibc 2.35, Qt 4.8.7). After some trial and error, I primarily followed this guide to set it up: https://www.showeq.net/forums/showth...wEQ-mini-guide. When launching it, I set it to use the NIC for my ethernet. I have tried all the steps with and without session tracking checked, and I do make sure to zone back and forth to try and get it working.


Under network diagnostics, it shows packets right away under "zone->client", and that's it. Once I set it to monitor EQ client IP address with the IP of my EQ machine / desktop, it begins to start showing packets for "client->zone", so it appears it is able to see traffic. It never shows any packets under world->client or client->world, for whatever that matters. I tried MAC filtering as well for physical address of my eq desktop, but didn't have any better luck there.


When looking at traffic under tcpdump on the showeq laptop, I do see various connections being made. <Desktop-Name>.lan:<port> to lvseq-chatxx when sending tells it seems. When I zone, I see connections eqworld-xx.everquest.com -> <Desktop-Name>.lan.<port>. I see plenty of back and forth traffic like eqzone-xx.everquest.com.<port> > <Desktop-Name>.lan:<port>, 2 way traffic. So I don't really know what I'm looking here except making assumptions, but it seems all that traffic indeed is visibile to the showeq laptop. I do specifically mention that it shows the name of the desktop under tcpdump instead of the actual IP (since I see troubleshooting tips people say to grep for the client IP, I need to grep for the PC name). However, its definitely the right machine- nslookup from the laptop of that name shows the IP I would expect that I am using to filter on.


When I zone, I do see it say in the showeq terminal "SessionRequest detected, pcap filter: EQ Client <Desktop_PORT>, Client port 57609, Server port 2128", as well as "PCAP Filter Set: udp and (portrange 9000-9007 or port 9876 or port 61332) and host <Desktop_PORT> and either proto 0x8800 and not broadcast and not multicast" so it seems it is able to see some of the traffic. I've rarely seen this, but while playing around today, I occasionally see "Warning: SEQ: Giving up on finding arg xxxx in stream zone-client cache, skipping!" After zoning again I haven't seen that pop up. I can't find anything else useful.


Any suggestions for anything I could be missing, or for any other troubleshooting steps?

[cn187]

For future reference, you can pass -n to tcpdump, and it will display IP addresses and port numbers instead of names.

Right after PCAP Filter Set and SessionRequest detected, you should see Zone: Entrycode Client, and then it should try to load the map. If you're not getting that, then it's not seeing the zone entry packet.

The 'Giving up on finding arq nnnn' implies SEQ isn't getting all the packets. If you look in the FAQ at the root of the source tree, question 5 goes into this and suggests possible fixes. Basically, you need to either reduce the non-EQ packets getting to your SEQ system, or you need to increase your SEQ system's ability to handle packets (or both).

This could be why you're having issues getting spawns, though I'd expect it to work somewhat intermittently rather than not at all. But since you're seeing that message, I'd start there.

Other questions that might help - How beefy is your SEQ box? How saturated is your network? Are you trying to use SEQ on Live, Test, or TLP?

[jars75]

For future reference, you can pass -n to tcpdump, and it will display IP addresses and port numbers instead of names.

Right after PCAP Filter Set and SessionRequest detected, you should see Zone: Entrycode Client, and then it should try to load the map. If you're not getting that, then it's not seeing the zone entry packet.

The 'Giving up on finding arq nnnn' implies SEQ isn't getting all the packets. If you look in the FAQ at the root of the source tree, question 5 goes into this and suggests possible fixes. Basically, you need to either reduce the non-EQ packets getting to your SEQ system, or you need to increase your SEQ system's ability to handle packets (or both).

This could be why you're having issues getting spawns, though I'd expect it to work somewhat intermittently rather than not at all. But since you're seeing that message, I'd start there.

Other questions that might help - How beefy is your SEQ box? How saturated is your network? Are you trying to use SEQ on Live, Test, or TLP?

Thanks for the thoughts so far! And yeah good to know on tcpdump.

Yeah, I'm not seeing the entrycode client line ever.

The "giving up on finding" is rare it looks like. I haven't seen it since, and I've been playing across multiple zones for a while. And yes, I'm getting nothing at all. I will still take a look at increasing that to be safe. I've zoned at least 30 times testing that am having no luck.

My SEQ box is not beefy. It's an older i5 laptop. My network has plenty on it, but I wouldn't say saturated. But I have doubts I would be batting 0% here.

Playing TLP.

[cn187]

Nothing else really jumps out at me.

Since you said this is your first attempt at setting it up, I'm going to assume you don't have stale build fragments from an earlier version laying around. But if by chance you started before with an earlier version and didn't finish, then started again with 6.3.10, you might want to double check that you're starting clean. (unpack/checkout into a new dir is the safest way).

6.3.10 is working for me and others, so I know the opcodes/structs are fine.

That really just leaves network or system issues.

I'm not sure there's much else I can suggest without logs/caps. If you feel comfortable providing those, then I can give you a way to get them to me (don't post them here, as they may contain sensitive info).

[jars75]

Nothing else really jumps out at me.

Since you said this is your first attempt at setting it up, I'm going to assume you don't have stale build fragments from an earlier version laying around. But if by chance you started before with an earlier version and didn't finish, then started again with 6.3.10, you might want to double check that you're starting clean. (unpack/checkout into a new dir is the safest way).

6.3.10 is working for me and others, so I know the opcodes/structs are fine.

That really just leaves network or system issues.

I'm not sure there's much else I can suggest without logs/caps. If you feel comfortable providing those, then I can give you a way to get them to me (don't post them here, as they may contain sensitive info).

I attempted the sqlctl changes, not seeing any improvement there unfortunately.

I installed 6.3.10 to start. I then installed a slightly older 6.2 version in a separate directory, with no success, so I went back to troubleshooting with 6.3.10.

If you would share what logs would be helpful and how to get them to you, I'd appreciate it!

[cn187]

Sorry - I didn't forget about you, just got a bit busy.

After thinking about this some more, since you may or may not be having capture/network issues, it might be best to narrow things down a bit further before we move to logs and such. (I don't think logs will be super useful if it's a capture or network issue).

Since there was a patch today, you'll want to start by updating/downloading the new version and doing a recompile/reinstall.

If you can install tcpdump/wireshark on your EQ machine and get a capture of a short play session, then you could copy that pcap (make sure it's pcap and not pcapng) to your SEQ box, then do a playback of the capture in SEQ. If SEQ works as expected when playing back the capture, then you know your SEQ installation is good and it's a network or system issue. If it doesn't work (and not failing for different reasons [1]), then it's probably something with your SEQ installation.

That would at least point you in a direction by eliminating one cause or the other.

If you're not able to do that test, then you could send me a capture of a short play session, which i can try to play back, and also dig through if it doesn't work. But the EQ->SEQ test would be have more diagnostic value.

[1] SEQ doesn't support ipv6 at all, and while the captures done by SEQ itself ignore ipv6 packets, playback of existing captures does not (fixing that is on my TODO list), so trying to play back a capture containing ipv6 traffic will have unpredictable results, and potentially cause SEQ to crash. So make sure when you do the capture, you filter out ipv6.

[BlueAdept]

Another thing you can try is making the linux box the gateway and then route internet through that. Something like this: internet - router - linux - different switch - EQ. This will elimate anything that might be blocking packets/ports. If that does not work, then it has to be a linux issue. I have never installed it on Mint, so I am not sure of the compatibility.

[jars75]

Sorry - I didn't forget about you, just got a bit busy.

After thinking about this some more, since you may or may not be having capture/network issues, it might be best to narrow things down a bit further before we move to logs and such. (I don't think logs will be super useful if it's a capture or network issue).

Since there was a patch today, you'll want to start by updating/downloading the new version and doing a recompile/reinstall.

If you can install tcpdump/wireshark on your EQ machine and get a capture of a short play session, then you could copy that pcap (make sure it's pcap and not pcapng) to your SEQ box, then do a playback of the capture in SEQ. If SEQ works as expected when playing back the capture, then you know your SEQ installation is good and it's a network or system issue. If it doesn't work (and not failing for different reasons [1]), then it's probably something with your SEQ installation.

That would at least point you in a direction by eliminating one cause or the other.

If you're not able to do that test, then you could send me a capture of a short play session, which i can try to play back, and also dig through if it doesn't work. But the EQ->SEQ test would be have more diagnostic value.

[1] SEQ doesn't support ipv6 at all, and while the captures done by SEQ itself ignore ipv6 packets, playback of existing captures does not (fixing that is on my TODO list), so trying to play back a capture containing ipv6 traffic will have unpredictable results, and potentially cause SEQ to crash. So make sure when you do the capture, you filter out ipv6.

No worries, appreciate the continued thoughts.

"[1] SEQ doesn't support ipv6 at all, and while the captures done by SEQ itself ignore ipv6 packets, playback of existing captures does not (fixing that is on my TODO list), so trying to play back a capture containing ipv6 traffic will have unpredictable results, and potentially cause SEQ to crash. So make sure when you do the capture, you filter out ipv6."

Can you help me understand this a little further? I do have IPv6 enabled. I assume you're saying normally this isn't an issue because EQ runs on IPv4 so with normal port mirroring this isn't an issue? (I'm a little ignorant on this- apologies).

"If you can install tcpdump/wireshark on your EQ machine and get a capture of a short play session, then you could copy that pcap (make sure it's pcap and not pcapng) to your SEQ box, then do a playback of the capture in SEQ. If SEQ works as expected when playing back the capture, then you know your SEQ installation is good and it's a network or system issue. If it doesn't work (and not failing for different reasons [1]), then it's probably something with your SEQ installation."

Haven't played with this on Windows but I imagine I can figure that part out. Assuming I can capture it, are there instructions somewhere I could reference to playback that capture in SEQ?

I'll start out updating my version- thanks.

[jars75]

No worries, appreciate the continued thoughts.

"[1] SEQ doesn't support ipv6 at all, and while the captures done by SEQ itself ignore ipv6 packets, playback of existing captures does not (fixing that is on my TODO list), so trying to play back a capture containing ipv6 traffic will have unpredictable results, and potentially cause SEQ to crash. So make sure when you do the capture, you filter out ipv6."

Can you help me understand this a little further? I do have IPv6 enabled. I assume you're saying normally this isn't an issue because EQ runs on IPv4 so with normal port mirroring this isn't an issue? (I'm a little ignorant on this- apologies).

"If you can install tcpdump/wireshark on your EQ machine and get a capture of a short play session, then you could copy that pcap (make sure it's pcap and not pcapng) to your SEQ box, then do a playback of the capture in SEQ. If SEQ works as expected when playing back the capture, then you know your SEQ installation is good and it's a network or system issue. If it doesn't work (and not failing for different reasons [1]), then it's probably something with your SEQ installation."

Haven't played with this on Windows but I imagine I can figure that part out. Assuming I can capture it, are there instructions somewhere I could reference to playback that capture in SEQ?

I'll start out updating my version- thanks.

Well, I certainly don't know what happened. And I did restart all my hardware (routers, PCs, switch) over the weekend (doing electrical work). But when I installed the new update today, it started running perfectly. Not sure exactly what it was here that fixed it, but it looks like I'm indeed good to go now. So sorry for confusion here and appreciate the support.

[cn187]

Can you help me understand this a little further? I do have IPv6 enabled. I assume you're saying normally this isn't an issue because EQ runs on IPv4 so with normal port mirroring this isn't an issue? (I'm a little ignorant on this- apologies).

Exactly. When SEQ does its own capture, it filters out ipv6, so it isn't an issue in normal usage. But playback of an existing capture uses different code that doesn't filter ipv6. So to play back a manual capture (from tcpdump/wireshark) in SEQ, you need to make sure that the capture doesn't contain ipv6 otherwise you're likely to have problems. But normal play should be fine.

Playback should be straightforward. If you run showeq with --help, it will give you what you need. But it's something like --playback-tcpdump-filename=/path/to/capture/file and --playback-speed=N where N is how fast to play back. Then if it's too fast/slow, you can adjust speed in the program from one of the menus (file menu I think?) or using ctrl-z/ctrl-x.