Black Raven Dragoons

[Zancarius]

So, I was monitoring my network traffic earlier while I was playing WoW and came to a rather interesting surprise. Apparently the server informs clients about guild ranks for guilds the player is not in. I'm not sure if this is based on individuals on your friends' list or whether it includes people who happen to be standing near you. Here's some sample data (it's from Snort logging in ASCII mode, so I apologize for the hex):

Code: Select all

00 D2 4F 92 CB 31 95 2F 00 45 76 65 72 79 74 68  ..O..1./.Everyth
69 6E 67 73 20 45 76 65 6E 74 75 61 6C 00 47 75  ings Eventual.Gu
69 6C 64 20 4D 61 73 74 65 72 00 43 6F 75 6E 63  ild Master.Counc
69 6C 00 4F 66 66 69 63 65 72 00 4D 65 6D 62 65  il.Officer.Membe
72 00 49 6E 69 74 69 61 74 65 00 41 6C 74 73 00  r.Initiate.Alts.
46 72 69 65 6E 64 73 00 54 72 79 20 4F 75 74 00  Friends.Try Out.
00 00 7E 00 00 00 10 00 00 00 05 00 00 00 10 00  ..~.............
00 00 2C 00 00 00 08 00 00 00 FC 97 CD 89 9A 24  ..,............$

It seems "council" or "council member" are pretty popular names for ranks.

Code: Select all

02 00 53 6D 6F 6B 65 72 73 20 55 6E 69 6F 6E 00  ..Smokers Union.
4C 65 61 64 65 72 00 4F 66 66 69 63 65 72 00 4D  Leader.Officer.M
65 6D 62 65 72 00 53 75 62 4D 65 6D 62 65 72 00  ember.SubMember.
49 6E 69 74 69 61 74 65 00 00 00 00 00 00 69 00  Initiate......i.

...and I was hoping for something like an "Emphysema" rank.

Code: Select all

00 00 05 00 00 00 2F E3 D1 24 EE F1 60 00 50 72  ....../..$..`.Pr
61 65 74 6F 72 69 61 6E 20 47 75 61 72 64 00 50  aetorian Guard.P
72 61 65 66 65 63 74 75 73 00 43 6F 2D 50 72 61  raefectus.Co-Pra
65 66 65 63 74 75 73 00 43 65 6E 74 75 72 69 6F  efectus.Centurio
6E 00 45 76 6F 63 61 74 69 00 42 61 6E 6B 65 72  n.Evocati.Banker
00 4C 65 67 69 6F 6E 6E 61 69 72 65 00 54 69 72  .Legionnaire.Tir
6F 00 43 69 74 69 7A 65 6E 00 00 00 00 00 00 00  o.Citizen.......

Mmmm. Latin.

Code: Select all

4F 77 20 4D 79 20 42 61 77 6C 73 00 47 72 6F 69  Ow My Bawls.Groi
6E 20 4B 69 63 6B 00 54 65 61 62 61 67 00 55 6E  n Kick.Teabag.Un
70 68 61 73 65 64 00 4D 65 6D 62 65 72 00 4E 75  phased.Member.Nu
62 6C 65 74 00 00 00 00 00 00 7E 00 00 00 0E 00  blet......~.....

^-- Doesn't surprise me one bit.

Code: Select all

00 6F B7 A5 F8 88 10 04 00 54 68 65 20 47 75 69  .o.......The Gui
6C 64 6C 65 73 73 00 50 72 65 73 69 64 65 6E 74  ldless.President
00 47 65 6E 65 72 61 6C 00 43 6F 6C 6F 6E 65 6C  .General.Colonel
00 4C 69 65 75 74 65 6E 61 6E 74 00 53 65 72 67  .Lieutenant.Serg
65 61 6E 74 00 43 6F 72 70 6F 72 61 6C 00 50 46  eant.Corporal.PF
43 00 50 72 69 76 61 74 65 00 43 6C 61 73 73 20  C.Private.Class
4C 65 61 64 65 72 00 41 6C 74 00 64 00 00 00 10  Leader.Alt.d....

Well, if you can't run it like a game... RUN IT LIKE THE ARMY!

Code: Select all

03 00 4D 61 63 68 69 61 76 65 6C 6C 69 61 6E 00  ..Machiavellian.
44 69 63 74 61 74 6F 72 00 46 6F 75 6E 64 65 72  Dictator.Founder
00 4F 66 66 69 63 65 72 00 4F 66 66 69 63 65 72  .Officer.Officer
20 41 6C 74 00 56 65 74 65 72 61 6E 00 52 61 69   Alt.Veteran.Rai
64 65 72 00 4D 65 6D 62 65 72 00 46 72 79 20 43  der.Member.Fry C
6F 6F 6B 00 54 68 65 20 4A 65 77 20 52 2E 49 2E  ook.The Jew R.I.
50 2E 00 00 26 00 00 00 01 00 00 00 05 00 00 00  P...&...........

I knew the founders must've known who Machiavelli was.

Anyway, that's probably enough. You get the point. It's interesting to me because this is PLAIN TEXT data sent over the wire. Anyone could see it (especially if you were on a wireless connection). It is really quite amazing the sort of things you'll catch when you're looking over your own traffic for something entirely unrelated. Though, it does explain a lot. Now I see why busy zones seem to really drain the system--it's because the client appears to load details about the guilds various nearby characters are in that it probably shouldn't.

So, next time you get logged out of Dalaran because it happens to be busy, remember this post.

[Zancarius]

More stuff...

Code: Select all

AE 89 9D 09 BE 0D 00 00 36 00 00 00 7C 63 66 66  ........6...|cff
66 66 66 66 30 30 54 68 65 20 41 6C 6C 69 61 6E  ffff00The Allian
63 65 20 69 73 20 67 61 69 6E 69 6E 67 20 63 6F  ce is gaining co
6E 74 72 6F 6C 20 6F 66 20 48 61 6C 61 61 21 7C  ntrol of Halaa!|
72 00                                            r.

...because knowing the status of Halaa is important to me when I'm in Dalaran.

Code: Select all

E5 98 CE 8A AD 8B 57 00 C3 89 70 C3 AD 63 00 47  ......[b]W...p..c[/b].G
75 69 6C 64 20 4D 61 73 74 65 72 00 43 4F 2D 47  uild Master.CO-G

Must be unicode. I think it's the one guild "Epic" with the accented E and I.

Code: Select all

00 00 00 00 11 00 00 00 41 72 63 61 6E 69 73 74  ........Arcanist
20 42 72 61 65 64 69 6E 00 00 00 00 00 00 00 00   Braedin........
00 88 00 00 00 52 65 69 6E 66 6F 72 63 65 6D 65  .....Reinforceme
6E 74 73 20 61 72 65 20 6E 65 65 64 65 64 20 6F  nts are needed o
6E 20 74 68 65 20 57 69 6E 74 65 72 67 72 61 73  n the Wintergras
70 20 62 61 74 74 6C 65 66 69 65 6C 64 21 20 20  p battlefield!
49 20 68 61 76 65 20 6F 70 65 6E 65 64 20 61 20  I have opened a
70 6F 72 74 61 6C 20 66 6F 72 20 71 75 69 63 6B  portal for quick
20 74 72 61 76 65 6C 20 74 6F 20 74 68 65 20 62   travel to the b
61 74 74 6C 65 20 61 74 20 54 68 65 20 53 69 6C  attle at The Sil
76 65 72 20 45 6E 63 6C 61 76 65 2E 00 00 65 5C  ver Enclave...e\

And then there's this guy. Spamming.

[Snobal]

Wow... that's really interesting. No wonder eveyone gets hosed in Dalaran...

Gotta love Snort. Oh... and I found this comical. The FireFox Skype addon actually found a phone number in all that hex:



Its a Singapore number... I wish I had some Skype credit so I could call that guy/girl up.

[Zancarius]

hahahahahaha

Snort packets, find numbers!

[Tirian]

You guys scare the hell out of me sometimes!

Except Sno. He's too tiny to be threatening.

[Celwyn]

Sugar you have not seen scary yet

[Zancarius]

Sugar you have not seen scary yet

This is very, very, very true. Celwyn scares me. She still needs to get out less, too.

Speaking of which, we've not seen you for a while Cel. Is everything going okay?

[Zancarius]

Oh, and if you're curious why there's so many dots in the text, it's because those are nulls and there's no real good way to represent it other than to use a dot (\0 is kind of awkward when you're trying to map hex one-to-one with single characters). That also boils down to a little lower level than most people are aware (but some probably remember). Strings in C/C++ are null terminated, which means that if you have a guild name, like "Black Raven Dragoons" in WoW, if it were sent over the network, the end result would be something like "Black Raven Dragoons\0".

There's a little trivia for you. The easiest way to spot it is to scroll up to a packet listed above and match the dots with 00s.

[alacor]

Sugar you have not seen scary yet

This is very, very, very true. Celwyn scares me. She still needs to get out less, too.

Speaking of which, we've not seen you for a while Cel. Is everything going okay?

She needs to get out more. Don't worry girl I got your back!!!!!!!!

[Tirian]

Alacor: A paladin in Wow, a rogue in real!

[Zancarius]

Alacor: A paladin in Wow, a rogue in real!

Well, they do do it from behind.

[Snobal]

Alacor: A paladin in Wow, a rogue in real!

Well, they do do it from behind.

:snickers: You said dodo.

</immature>