Post by: mike315 on February 26, 2007, 11:45:00 AM
I have a switch that can port mirror also...which would be ideal for capturing with ethereal(or whatever its called now)...
Wrong forum though...this would be more suited to the Development or "Utilities that run on your pc" forums.
If I get a friend over anytime soon with another xbox, i'll see what I can whip up.
Post by: Ctrl_phreak on February 26, 2007, 01:19:00 PM
I am looking for packet captures from at minimum of 4 xboxes hooked up to a switch.
The packet capture must be either at each of the red points or from the switch(es) itself.
I would like to try this on several games to optimize traffic for multiple games.
If you are interested in helping me in this project please contact me at [email protected]
or just check out my site for a full article on the idea.
WhiteHatBlackHat.com
Post by: Ctrl_phreak on February 26, 2007, 01:21:00 PM
I am looking for packet captures from at minimum of 4 xboxes hooked up to a switch.
The packet capture must be either at each of the red points or from the switch(es) itself.
I would like to try this on several games to optimize traffic for multiple games.
If you are interested in helping me in this project please contact me at [email protected]
or just check out my site for a full article on the idea.
WhiteHatBlackHat.com
Post by: Ctrl_phreak on February 26, 2007, 01:31:00 PM
--Get to the point that the each particular game "host's" a new game. If you can capture this I can see how different games send out indications that a new lobby exists. Same for "joining" a game.
--Also start the capture before the game(s) are created.
I only have halo 1 so I am quite limited to seeing systemlink traffic, but i do know it varies from game to game. I conjecture that only the packet length is going to change but I want to be sure.
Let me know if you are interested in helping still or need help in setting up the Cap system properly.
Thanks for your interest!
--Ctrl Phreak
Post by: noselessmonk on February 26, 2007, 07:33:00 PM
I think that is similar to what you are looking at...the page has some info on it too.
Post by: Ctrl_phreak on February 26, 2007, 09:06:00 PM
Similarities:
--based on libpcap for packet capturing
--based on libnet for packet injection
Differences:
--Not console based, I'm going to build a user interface.
--Using Java, so the program will run on almost any platform (not only a Linux software, sorry most of us use windows)
--Chat feature so people can coordinate games without having to rely on some other method like MSN or a cell phone.
I have used xboxproxy for quite some time and am trying to make this kind of software more useful to the average user.
Post by: mike315 on February 27, 2007, 06:24:00 AM
QUOTE(Ctrl_phreak @ Feb 26 2007, 11:13 PM) 
Yup, it's almost exactally like that.
Similarities:
--based on libpcap for packet capturing
--based on libnet for packet injection
Differences:
--Not console based, I'm going to build a user interface.
--Using Java, so the program will run on almost any platform (not only a Linux software, sorry most of us use windows)
--Chat feature so people can coordinate games without having to rely on some other method like MSN or a cell phone.
I have used xboxproxy for quite some time and am trying to make this kind of software more useful to the average user.
It has the source, thats a plus. Has to help you some...Is your project going to be opensource?
Post by: torne on February 27, 2007, 07:52:00 AM
Having looked at your site, one more thing: compression is unlikely to help much as encrypted data compresses very badly (and is usually compressed underneath the encryption layer anyway).
Don't get me wrong, it's a good idea (a portable, easy to use system link proxy that understands upnp and other magic would be great) - but I think you have assumed it's possible to do more than you realistically can. The data you're asking for are mostly unnecessary (nothing special about >2 boxes, nothing special about different games).
Post by: Ctrl_phreak on February 27, 2007, 11:43:00 AM
I apologize, I am not familiar with the nature of the traffic. Only some programing background and a desire to expand my gaming to a neighboring college. I figured it would be a worthy cause to let the project be public.
Post by: RMM on February 27, 2007, 05:29:00 PM
Post by: mike315 on February 27, 2007, 06:35:00 PM
Any specific filter....ip 0.0.0.1, any specific tcp port?
lol this thread really needs to get moved to the proper forum(wherever that may be)
Post by: torne on February 28, 2007, 04:11:00 AM
QUOTE(Ctrl_phreak @ Feb 27 2007, 06:50 PM)
It sounds like you know alot about the SystemLink traffic model. Would you mind sharing what you know, or provide revelavant links? It would be wonderful if i don't have to sift through etherreal to come up with a packethandler.
I got my information from the XDK. Thus, I can't link you to it. It's not particularly verbose on the specifics of the protocol, but the general parts (traffic encrypted and encapsulated by standard MS system link libraries, etc) are explained.
QUOTE
I apologize, I am not familiar with the nature of the traffic. Only some programing background and a desire to expand my gaming to a neighboring college. I figured it would be a worthy cause to let the project be public.
Oh, don't apologise: if you knew nothing about the protocol beforehand then you started your investigation in an entirely reasonable fashion! If I came across as dismissive, it's only because the majority of the posts I actually reply to on these forums are people asking how to do really stupid things that clearly won't work
I hope your project succeeds, as you sound like you have a good actual plan for a useful tool. But, I can't really provide you with much more help than the information I've already posted, as I have no source of information other than the XDK and I only have one Xbox and haven't bothered to configure any of the existing tunnelling programs, so I don't have any traffic to observe either
Post by: Ctrl_phreak on March 01, 2007, 05:37:00 PM
New game is hosted, this is broadcasted (either solicited or unsolicited)
client xbox's request to join and communication starts with one to one/unicasted
fairly simple. Little more complex so i may revisit my traffic handling model. This is all just hear-say from fourms and I would still love any PCAP's you can throw my way.
Does this sound about right to anyone who knows the traffic model?
Ctrl Phreak
Post by: RMM on March 02, 2007, 09:20:00 AM
Post by: Ctrl_phreak on March 02, 2007, 02:36:00 PM
QUOTE(RMM @ Mar 2 2007, 05:27 PM)
One thing I remember reading regarding both XBConnect and the up coming Xlink One that might be helpful is both remove the Ethernet and IP header of the UDP packet and reassemble those on the other end to save overhead bandwidth. If you haven't already implemented something like that it might be something to consider to help make it as efficient as can be.
One needs the header to send out the the Net don't I? I'm not encapsulating at all, as of now i am only rewriting the packets and sending to a new destination (other proxy) which again re-adresses it to the other xboxes. I will probally change that but i would like to get a system working before that. Could you print out a Ethernet Frame and outline how to send it without a header? I don't quite understand.
Post by: RMM on March 03, 2007, 09:32:00 AM
Also one other thing is Xlink Kai has a java based UI thats open source so maybe you could look at that for a few ideas. Now this wont tell you anything regarding the Ethernet and IP headers being removed and reconstructed as that is a feature for the up coming Xlink One (which is in beta) but it might help you in other areas of your project.
open source jKaiUI:
http://jkaiui.sourceforge.net/
Here is the thread on the Xlink forums talking about stripping of the Ethernet header and IP header. Nobody says exactly how its done but Tod_XBC from XBConnect gives a brief rundown. If you have any questions maybe one of those guys will help.
http://www.teamxlink...3830b62033a6cdf