Print

[mike315]

Awesome project, wish i could help, but only have one xbox right now.

I have a switch that can port mirror also...which would be ideal for capturing with ethereal(or whatever its called now)...

Wrong forum though...this would be more suited to the Development or "Utilities that run on your pc" forums.

If I get a friend over anytime soon with another xbox, i'll see what I can whip up.

[Ctrl_phreak]

Alright, here's the scoop. I am building a Java based program that will allow people to easily setup their own private service similar to XBC. To do this I would like to see some examples of SystemLink traffic.

I am looking for packet captures from at minimum of 4 xboxes hooked up to a switch.



The packet capture must be either at each of the red points or from the switch(es) itself.

I would like to try this on several games to optimize traffic for multiple games.

If you are interested in helping me in this project please contact me at [email protected]
or just check out my site for a full article on the idea.

WhiteHatBlackHat.com

[Ctrl_phreak]

Alright, here's the scoop. I am building a Java based program that will allow people to easily setup their own private service similar to XBC. To do this I would like to see some examples of SystemLink traffic.

I am looking for packet captures from at minimum of 4 xboxes hooked up to a switch.



The packet capture must be either at each of the red points or from the switch(es) itself.

I would like to try this on several games to optimize traffic for multiple games.

If you are interested in helping me in this project please contact me at [email protected]
or just check out my site for a full article on the idea.

WhiteHatBlackHat.com

[Ctrl_phreak]

Actually, you can still help.  You can still do a couple of things for if you have more than one game that has system link:

--Get to the point that the each particular game "host's" a new game.  If you can capture this I can see how different games send out indications that a new lobby exists.  Same for "joining" a game.
--Also start the capture before the game(s) are created.  

I only have halo 1 so I am quite limited to seeing systemlink traffic, but i do know it varies from game to game.   I conjecture that only the packet length is going to change but I want to be sure.

Let me know if you are interested in helping still or need help in setting up the Cap system properly.

Thanks for your interest!

--Ctrl Phreak

[noselessmonk]

Might wanna take a look at this xboxproxy website

I think that is similar to what you are looking at...the page has some info on it too.

[Ctrl_phreak]

Yup, it's almost exactally like that.

Similarities:
--based on libpcap for packet capturing
--based on libnet for packet injection

Differences:
--Not console based, I'm going to build a user interface.
--Using Java, so the program will run on almost any platform (not only a Linux software, sorry most of us use windows)
--Chat feature so people can coordinate games without having to rely on some other method like MSN or a cell phone.

I have used xboxproxy for quite some time and am trying to make this kind of software more useful to the average user.

[mike315]

QUOTE(Ctrl_phreak @ Feb 26 2007, 11:13 PM)

Yup, it's almost exactally like that.

Similarities:
--based on libpcap for packet capturing
--based on libnet for packet injection

Differences:
--Not console based, I'm going to build a user interface.
--Using Java, so the program will run on almost any platform (not only a Linux software, sorry most of us use windows)
--Chat feature so people can coordinate games without having to rely on some other method like MSN or a cell phone.

I have used xboxproxy for quite some time and am trying to make this kind of software more useful to the average user.

It has the source, thats a plus. Has to help you some...Is your project going to be opensource?

[torne]

System link traffic is encrypted and all games communicate using the same externally observable protocols/ports/etc. There is nothing required for proxying system link play other than just blindly forwarding all the traffic across to another network. You can't realistically do any kind of 'optimisation' as there's no way to tell what packets are particularly special; all games will look the same on the wire, except in the volume and frequency of data they send, which doesn't do a great deal for you

Having looked at your site, one more thing: compression is unlikely to help much as encrypted data compresses very badly (and is usually compressed underneath the encryption layer anyway).

Don't get me wrong, it's a good idea (a portable, easy to use system link proxy that understands upnp and other magic would be great) - but I think you have assumed it's possible to do more than you realistically can. The data you're asking for are mostly unnecessary (nothing special about >2 boxes, nothing special about different games).

[Ctrl_phreak]

It sounds like you know alot about the SystemLink traffic model.  Would you mind sharing what you know, or provide revelavant links?  It would be wonderful if i don't have to sift through etherreal to come up with a packethandler.

I apologize, I am not familiar with the nature of the traffic.  Only some programing background and a desire to expand my gaming to a neighboring college.  I figured it would be a worthy cause to let the project be public.

[RMM]

Sounds like a great project.  Have you talked to the XBConnect or XLink guys to see if they would share any info?  They might give you a tip or two.

[mike315]

I'll try to get some pcaps for you this weekend. Im hoping to just use a crossover cable to my laptop and capture that way. I have an 80port procurve that can mirror ports, but its in the basement running my whole network, and i dont wanna move it around for this...but i will if i have to!

Any specific filter....ip 0.0.0.1, any specific tcp port?

lol this thread really needs to get moved to the proper forum(wherever that may be)

[torne]

QUOTE(Ctrl_phreak @ Feb 27 2007, 06:50 PM)

It sounds like you know alot about the SystemLink traffic model.  Would you mind sharing what you know, or provide revelavant links?  It would be wonderful if i don't have to sift through etherreal to come up with a packethandler.

I got my information from the XDK. Thus, I can't link you to it. It's not particularly verbose on the specifics of the protocol, but the general parts (traffic encrypted and encapsulated by standard MS system link libraries, etc) are explained.

QUOTE

I apologize, I am not familiar with the nature of the traffic.  Only some programing background and a desire to expand my gaming to a neighboring college.  I figured it would be a worthy cause to let the project be public.

Oh, don't apologise: if you knew nothing about the protocol beforehand then you started your investigation in an entirely reasonable fashion! If I came across as dismissive, it's only because the majority of the posts I actually reply to on these forums are people asking how to do really stupid things that clearly won't work

I hope your project succeeds, as you sound like you have a good actual plan for a useful tool. But, I can't really provide you with much more help than the information I've already posted, as I have no source of information other than the XDK and I only have one Xbox and haven't bothered to configure any of the existing tunnelling programs, so I don't have any traffic to observe either

[Ctrl_phreak]

Good news, i'm registered on SourceForge.net. (http://sourceforge.n...jects/boxphreak).  I will have a CVS/Subversion up this weekend to show everyone what i have going so far.  The meat of the program is still missing, as in the code that handles the actual packet transferring.  I posted a hierarchy of my current skeleton at both my web and SF.net.  From what I gather from both the XLink guys, Google, and these forums, SystemLink on a LAN uses port 3074 exclusively.  All boxes assume a address of 0.0.0.1 (although each responds to a "real" IP if you check all IP's with ARP :-) ) and use MAC only to communicate.  Communication comes in two flavors, broadcast, and p2p/unicast.  Well actually broadcast and multicast, but for my purposes, they are the same.  Games are described as follows:

New game is hosted, this is broadcasted (either solicited or unsolicited)
client xbox's request to join and communication starts with one to one/unicasted

fairly simple.  Little more complex so i may revisit my traffic handling model.  This is all just hear-say from fourms and I would still love any PCAP's you can throw my way.

Does this sound about right to anyone who knows the traffic model?

Ctrl Phreak

[RMM]

One thing I remember reading regarding both XBConnect and the up coming Xlink One that might be helpful is both remove the Ethernet and IP header of the UDP packet and reassemble those on the other end to save overhead bandwidth.  If you haven't already implemented something like that it might be something to consider to help make it as efficient as can be.

[Ctrl_phreak]

QUOTE(RMM @ Mar 2 2007, 05:27 PM)

One thing I remember reading regarding both XBConnect and the up coming Xlink One that might be helpful is both remove the Ethernet and IP header of the UDP packet and reassemble those on the other end to save overhead bandwidth.  If you haven't already implemented something like that it might be something to consider to help make it as efficient as can be.

One needs the header to send out the the Net don't I?  I'm not encapsulating at all, as of now i am only rewriting the packets and sending to a new destination (other proxy) which again re-adresses it to the other xboxes.  I will probally change that but i would like to get a system working before that.  Could you print out a Ethernet Frame and outline how to send it without a header?   I don't quite understand.