Mysterious packets sent to eqzone-33.everquest.com

2

While doing a casual packet capture I happened to notice an infrequent, yet constant stream of UDP packets. The packets in question contained the following:

Destination: eqzone-33.everquest.com
Destination-port: 20060

The packets seemed to also randomize the source port.

What's really creepy though is the ASCII in the Packet data which reads:

ExternalLogging

Anyone have any clue what this is coming from?

Also is this the right place for such a question?

randomPrime

Posted 2012-11-19T01:15:11.987

Reputation: 21

Random ports? That sounds bad (well usually, unless you are using a P2P program). Do you play EverQuest? – Synetech – 2012-11-19T01:39:14.320

@syntech Nope. The plot thickens. :| – randomPrime – 2012-11-19T01:40:47.597

You said that you noticed it while sniffing packets; what process was making the connection? Have you checked for auto-runs and running processes in the Task Manager yet?

– Synetech – 2012-11-19T01:42:11.690

If this is a windows box, you can use netstat -p udp -anb to figure out the process sending the udp packets. Cross reference with Tast Manager process tab, after you enabled PID in the view/columns options. – Paul – 2012-11-19T02:46:03.313

@Synetech I just figured it out; It was a Planetside 2 client I had running in Wine (Wine Is Not Emulation); I guess this is some form of DRM – randomPrime – 2012-11-19T02:52:31.810

It makes sense because both are by Sony who is notorious for its DRM. Curious though that PS2 would use EQ’s servers, but maybe it’s temporary since PS2 won’t be officially released until Tuesday. Also, the beta ended yesterday, so maybe the pinging is a way to prevent it from running anymore. – Synetech – 2012-11-19T03:23:44.880

@synetech It wouldn't make a difference, the entire launcher is run on awesomenium (i.e. it's a webapp) so they can easily prevent people from launching it without the UDP packet thing. Grrr. I can't self answer for a 4+ hours. You want to do the honors? – randomPrime – 2012-11-19T03:27:22.150

I think you can delete the question now since it was not an actual issue and likely to be closed as “too localized” anyway. – Synetech – 2012-11-19T05:29:52.670

Answers

1

Actually it's the content server, to download the game, which it tries to reach (in vain currently, as there seems to be a problem). It retries in 10 seconds interval. Might additionally also be the lobby mechanism though.

Fireball

Posted 2012-11-19T01:15:11.987

Reputation: 11

Asked: 2012-11-19T01:15:11.987

Viewed: 86 times

Active: 2012-11-21T07:57:20.887