Capturing Packets

A packet capture is a recording of everything a game client and a game server said to each other. It is the single most useful thing anybody outside this project can give us, and recording one takes about ten minutes.

Why It Matters

Every server here has to speak a language we did not design. The client is a program we cannot change, so the server has to say exactly what that client expects, byte for byte, in the right order. There are only two ways to learn what that is.

Reading the client. Take the game's executable apart and work out what each message means from the code that builds and reads it. This works, it is how most of these servers were written, and it is slow. It also produces answers that are probably right: a field read out of a disassembler is a guess about intent until something confirms it.

Reading a capture. Watch a real client talk to a real server and the guessing stops. The bytes are the answer. A single recording of a login, a fight and a trade can settle in an afternoon what weeks of reading the binary only narrowed down.

Captures are also the only thing that catches a whole class of mistake. A fact derived from a client is a fact about that client; a capture proves what the two ends actually did. Several long-standing defects in these servers existed because a message was implemented from the code and never checked against the wire.

Any capture is worth having, including a short one, including one where nothing interesting happened. Logging in and standing still for thirty seconds records the handshake, the world entry and the keepalive, and those are three of the things hardest to get right.

What You Need

• Wireshark, from wireshark.org. The default installation is right. On Windows say yes to Npcap when the installer offers it; that is the part that does the capturing.
• A game client, and a server for it to talk to. Anything counts: an original server still running somewhere, a private server, a server pack you started on your own machine, or one of ours.
• A throwaway account. Read the privacy note below before you record anything.

Recording a Capture

1. Pick the interface

Open Wireshark. The first screen lists your network interfaces with a little activity graph beside each one. The one that is moving while you browse the web is almost always the right one: Ethernet or Wi-Fi.

If the server is on the same machine as the client, that is not enough. Traffic to 127.0.0.1 never touches your network card. Pick Adapter for loopback traffic capture instead, which Npcap installs on Windows; on Linux it is the interface called lo.

2. Set a capture filter

Type a filter into the box on that same screen, before you start. This is not the same as the display filter at the top of the main window: a capture filter decides what gets recorded, which keeps the file small and keeps everything else on your machine out of it.

If you do not know the port, host <address> alone is fine. If you do not know the address either, record with no filter and keep the session short.

3. Start recording BEFORE you launch the game

Press the blue shark fin to start, then start the client.

This is the part people get wrong, and it costs the most valuable half of the recording. Everything that decides how the rest of the conversation is encoded happens in the first second: the version check, the handshake, and on several of these games the encryption keys, which are handed over once and never mentioned again. A capture that starts after the login screen is a capture we may not be able to decode at all.

4. Play

Do ordinary things and remember what you did. Useful things to include, roughly in order:

1. Log in, pick a character, enter the world.
2. Walk somewhere. Stop. Walk again.
3. Kill something.
4. Open your inventory, equip something, use a potion.
5. Talk to a shop NPC, buy something, sell something.
6. Say something in chat.
7. Log out cleanly.

Five minutes is plenty. A long recording is not more useful than a short one, and it is harder to read.

5. Stop and save

Press the red square, then File, Save As. Keep the default format, pcapng. Name it something that says what it is: rf2232-login-and-trade.pcapng.

Sending It To Us

Attach it to a bug report, or get in touch from the contact page if it is large.

A capture on its own is worth much less than a capture with a note. Tell us:

• Which game and which version, and which client build if you know it. For RF Online that is the file size and date from game clients.
• What the server was. An original service, a private server, a server pack you ran yourself.
• What you did, in order, with rough times if you can. "Logged in at 0:05, killed something around 1:30, traded at 3:00" turns an opaque file into a map.
• Anything that went wrong. A disconnection or an error in the middle of a capture is often the most useful part of it.

Before You Record: Privacy

A capture records everything on the filter you set, exactly as it was sent.

Several of these games send your password in the clear. If the client and server do not encrypt the login, your password is in the file in plain text, and so is your account name. Use an account you do not care about, on a password you use nowhere else, and make it before you start recording.

A capture also contains your own IP address, the server's, and anything you typed in chat. Do not post one publicly without looking at it first, and do not record other people's sessions.

Wireshark can record every packet on your machine, not only the game's. That is why the capture filter in step 2 matters: with host <address> set, nothing else you do while recording is in the file.

What Not To Send

• A screenshot of Wireshark. The bytes are the point, and a picture of them is not usable. Send the file.
• A .pcap converted to text, or a copy-paste of the packet list. Same reason.
• A capture of one of our own servers, unless something is going wrong on it. We already have both ends of that conversation.