Packet Collecting
Packet collecting EVE is relatively simple since it is TCP. The current method for packet collecting is to grab Ethereal and use it (You will need
WinPCap too, use 3.1+ if you have dialup).
**You need to start your packet collects BEFORE you log in, and its best to stop them after you are logged out. THIS MEANS THAT YOUR PASSWORD IS STORED IN THE PACKET COLLECTS, IT IS RECOMMENDED TO CHANGE YOUR PASSWORD TO SOMETHING TEMPORARY BEFORE COLLECTING, AND CHANGE IT BACK WHEN YOU ARE FINISHED**
Please always run the CCP log server which comes with EVE whenever you are doing packet collects so we can see the client's view of the world too
Packet Collecting
NOTE: This currently does not work on the live CCP servers, as they employ crypto. It will however work on evemu.
To collect TCP with ethereal on the maching running EVE, do this:
- before you do anything: in the filter field, enter: tcp.port == 26000, this will prevent you from getting swamped when you finish.
- Capture -> Start (Ctrl-K)
- Select your outgoing network interface (what the packets will be traveling through)
- type in the capture filter: port 26000
- Enter a new path/file name in the "Capture File" section, generally with a .pcap extension.
- Hit OK.
It will collect into that file until you hit done. You can repeat this process as many times as you want (but make sure you line up your logserver activities).
CCP Log Server
Always run the CCP log server whenever you are packet collecting in order to maximize the usefulness of your packet collects.
Running the log server is relatively simple:
- Run logserver.exe from your EVE directory BEFORE starting EVE
- Open a new workspace (File -> New Workspace)
- ... let it log while you are collecting ...
- Once you are logged out or have ended your packet collect, "save workspace as.." in the same place you are putting your .pcap files, please name it the same thing as the pcap file with their .lbw extension instead of pcap.This
