Page 1 of 1

Need a hint

Posted: Thu Dec 26, 2013 8:16 am
by afk5min
I was looking on what to replace dated sniffers to sniff retail packets, and discovered this:
Image

By any chance, could someone elaborate on:
What is the name of this sniffer?
Where could I get it?
What is the latest protocol version supported?

Re: Need a hint

Posted: Mon Dec 30, 2013 7:40 pm
by lord_rex
I would really like to know it also.. :)

Re: Need a hint

Posted: Wed Jan 01, 2014 6:43 am
by Hyrelius
Hey there,

while I am not sure if I am even allowed to write down the information here - nor do I take any responsibility as to its correctness or any other means - I still think I can give you a hint or two.

I used to look into l2phx. It seems to support Freya and probably GoD, though my version had trouble with the latter as it didn't come with predefined packet descriptions (as seen in the right panel of your first screenshot) for GoD.

It was hard to configure so I cannot really elaborate on that. I just know I finally managed to get it to work. By the way: at least Microsoft Security Essentials recognize the executable file as a threat, which I'm pretty sure it's not.

Not a pro regarding packet sniffing though as I only tried it once to determine if a certain action triggers sending a packet or not.

Happy New Year,
Hyrelius.

Edit: oh yeah - just remembered: the tool isn't made by L2J - so I doubt they will be supporting it. If it was for debugging packets, you might want to look into this option somewhere in the configuration files. But since you seem to aim for something different, either look into that tool or wait for a more precise answer :).

Re: Need a hint

Posted: Wed Jan 01, 2014 12:51 pm
by jurchiks
The tool needs to attach itself to the l2 process to sniff packets, that's why it's being recognised as a threat. It isn't actually a virus.

There are tools like WireShark that don't attach themselves to processes (afaik), but they require additional setup to get it to work with l2 and there is no such packet info support in those.

Re: Need a hint

Posted: Wed Jan 01, 2014 1:02 pm
by afk5min
Hyrelius wrote:I used to look into l2phx. It seems to support Freya and probably GoD, though my version had trouble with the latter as it didn't come with predefined packet descriptions (as seen in the right panel of your first screenshot) for GoD.
The bad thing is, while it may have been a nice tool in GF times (so... like 3-3.5 years ago), seeing as it even supported client opcode scrambling (the l2.ru mode) required for retail sniffing, the last update was...
Date: August 3, 2011 16:23:40
Which was some Freya-related stuff (a.k.a. long dead and obsolete). During HF times, I used packetsamurai adapted to L2, but it was (is) lacking, not to mention the overall slowness and memory footprint :P

Perhaps any other similar tools you know? Because that one screenshot is all I have on this one.

Re: Need a hint

Posted: Tue Oct 21, 2014 4:32 pm
by otsaki5
Can someone link the sniffer name or location to download? thank you!