Packet Startup sequence
Below is listed the communication on the client, "battlezone", with the server, "moorea".If we look at the raw packet data, we can see all the information, including the Ethernet, IP, and UDP header information.
%snoop -i captureFile -V -x 0 | more
________________________________
1 0.00000 battlezone -> moorea ETHER Type=0800 (IP), size = 128 bytes
1 0.00000 battlezone -> moorea IP D=129.146.86.171 S=129.144.251.148 LEN=114, ID=10317
1 0.00000 battlezone -> moorea UDP D=27500 S=27001 LEN=94
0: 00e0 b028 8081 0800 2086 8c4b 0800 4500 ...(.... ..K..E.
16: 0072 284d 4000 ff11 fdca 8190 fb94 8192 .r(M@.......û...
32: 56ab 6979 6b6c 005e 9d65 ffff ffff 636f V.iykl.^.e....co
48: 6e6e 6563 7420 225c 6e6f 6169 6d5c 305c nnect "\noaim\0\
64: 6d73 675c 315c 7261 7465 5c32 3530 305c msg\1\rate\2500\
80: 626f 7474 6f6d 636f 6c6f 725c 345c 746f bottomcolor\4\to
96: 7063 6f6c 6f72 5c34 5c73 6b69 6e5c 6875 pcolor\4\skin\hu
112: 6c6b 5c6e 616d 655c 5370 616e 6b79 220a lk\name\Spanky".
We don't need to see all this stuff so let's skip the first 42 bytes in the header. In the following packet, we can see the header of a control message, beginning with ffff ffff (four bytes of 255 or 0xff).
%snoop -i captureFile -V -x 42 | more
________________________________
1 0.00000 battlezone -> moorea ETHER Type=0800 (IP), size = 128 byte
s
1 0.00000 battlezone -> moorea IP D=129.146.86.171 S=129.144.251.14
8 LEN=114, ID=10317
1 0.00000 battlezone -> moorea UDP D=27500 S=27001 LEN=94
0: ffff ffff 636f 6e6e 6563 7420 225c 6e6f ....connect "\no
16: 6169 6d5c 305c 6d73 675c 315c 7261 7465 aim\0\msg\1\rate
32: 5c32 3530 305c 626f 7474 6f6d 636f 6c6f \2500\bottomcolo
48: 725c 345c 746f 7063 6f6c 6f72 5c34 5c73 r\4\topcolor\4\s
64: 6b69 6e5c 6875 6c6b 5c6e 616d 655c 5370 kin\hulk\name\Sp
80: 616e 6b79 220a anky".
The return message from the server, moorea, arrives and it is also a control message beginning with ffff ffff and the message is 0x6a, or the character 'j'. I take this to be some type of accept message.
________________________________
2 0.02120 moorea -> battlezone ETHER Type=0800 (IP), size = 60 bytes
2 0.02120 moorea -> battlezone IP D=129.144.251.148 S=129.146.86.171 LEN=33, ID=48863
2 0.02120 moorea -> battlezone UDP D=27001 S=27500 LEN=13
0: ffff ffff 6a00 0000 0000 0000 0000 0000 ....j...........
16: 0000 ..
Now, battlezone sends the first game message. The packet id is an integer, and integers are composed of four bytes. Hence, the first four bytes of the message are the packet id (in this case 0) which his bit 31 set. These are sent in little-ending order- lowest order byte first.To set the 31st bit, 0000 0000 is or'd with 8000 0000 (bit 31), the result is 8000 0000, and in little-endian notation, this is 0000 0080.
The second four bytes, 0000 0000, is the integer id of the last packet received from the server.
The game message is 0x04, which is the code for a console order. The console command is 0x6e 0x65 0x77, which is the string, "new". 0x00 denotes the end of the string. Strange as it may seem, but console commands are used at startup.
Finally, the packet ends with byte 0x03 plus nine bytes of 0x00. I don't know what this is for, but it's sent often as a tail of a packet.
________________________________
3 0.17295 battlezone -> moorea ETHER Type=0800 (IP), size = 65 bytes
3 0.17295 battlezone -> moorea IP D=129.146.86.171 S=129.144.251.14
8 LEN=51, ID=10318
3 0.17295 battlezone -> moorea UDP D=27500 S=27001 LEN=31
0: 0000 0080 0000 0000 046e 6577 0003 0000 .........new....
16: 0000 0000 0000 00 .......
Looks like the 50ms timeout was reached, and so the client sends a new packet, with id=1. (This time bit 31 is not set.) It indicates that the last packet received from the server had id=0. This is followed by 0x03 with nine bytes of 0x00.
________________________________
4 0.11692 battlezone -> moorea ETHER Type=0800 (IP), size = 60 bytes
4 0.11692 battlezone -> moorea IP D=129.146.86.171 S=129.144.251.148 LEN=46, ID=10319
4 0.11692 battlezone -> moorea UDP D=27500 S=27001 LEN=26
0: 0100 0000 0000 0000 0300 0000 0000 0000 ................
16: 0000 ..
The server answers.
The first four bytes, 0100 0000, tells the client that this is the first game packet it has sent, using packet id=1. The next four bytes, 0100 0000 indicates that the last packet received from the client was packet id=1. So it did receive the last packed the client sent.
________________________________
5 0.00552 moorea -> battlezone ETHER Type=0800 (IP), size = 60 bytes
5 0.00552 moorea -> battlezone IP D=129.144.251.148 S=129.146.86.171 LEN=36, ID=48864
5 0.00552 moorea -> battlezone UDP D=27001 S=27500 LEN=16
0: 0100 0000 0100 0000 0000 0000 0000 0000 ................
16: 0000 ..
This is a client packet with id=2. The last server packet received was packet id=1. The message is the mysterious code 0x03 followed by nine bytes, and ends with code 0x20.
________________________________
6 0.04201 battlezone -> moorea ETHER Type=0800 (IP), size = 61 bytes
6 0.04201 battlezone -> moorea IP D=129.146.86.171 S=129.144.251.14
8 LEN=47, ID=10320
6 0.04201 battlezone -> moorea UDP D=27500 S=27001 LEN=27
0: 0200 0000 0100 0000 0300 0000 0000 0080 ................
16: 0000 20 ..
________________________________
7 0.00503 moorea -> battlezone ETHER Type=0800 (IP), size = 60 bytes
7 0.00503 moorea -> battlezone IP D=129.144.251.148 S=129.146.86.17
1 LEN=36, ID=48865
7 0.00503 moorea -> battlezone UDP D=27001 S=27500 LEN=16
0: 0200 0000 0200 0000 0000 0000 0000 0000 ................
16: 0000 ..
________________________________
8 0.01065 battlezone -> moorea ETHER Type=0800 (IP), size = 67 bytes
8 0.01065 battlezone -> moorea IP D=129.146.86.171 S=129.144.251.14
8 LEN=53, ID=10321
8 0.01065 battlezone -> moorea UDP D=27500 S=27001 LEN=33
0: 0300 0080 0200 0000 046e 6577 0003 0000 .........new....
16: 0080 0000 2080 0000 20 .... ...
________________________________
9 0.00641 moorea -> battlezone ETHER Type=0800 (IP), size = 317 byte
s
9 0.00641 moorea -> battlezone IP D=129.144.251.148 S=129.146.86.17
1 LEN=303, ID=48866
9 0.00641 moorea -> battlezone UDP D=27001 S=27500 LEN=283
0: 0300 0080 0300 0080 0b19 0000 002e 0000 ................
16: 0071 7700 0154 6865 2057 6172 7265 6e00 .qw..The Warren.
32: 0000 4844 0000 c842 0000 a043 0000 fa43 ..HD...B...C...C
48: 0000 2041 3333 333f 0000 2041 0000 c040 .. A333?.. A...@
64: 0000 803f 0000 803f 2006 0966 756c 6c73 ...?...? ..fulls
80: 6572 7665 7269 6e66 6f20 225c 7465 616d erverinfo "\team
96: 706c 6179 5c30 5c6d 6178 7370 6563 7461 play\0\maxspecta
112: 746f 7273 5c38 5c73 7061 776e 5c30 5c2a tors\8\spawn\0\*
128: 7665 7273 696f 6e5c 322e 3130 5c68 6f73 version\2.10\hos
144: 746e 616d 655c 4261 7369 6320 5175 616b tname\Basic Quak
160: 655b 776f 726c 645d 2028 4361 6e65 2054 e[world] (Cane T
176: 6f61 6429 5c64 6561 7468 6d61 7463 685c oad)\deathmatch\
192: 335c 6d61 7863 6c69 656e 7473 5c31 365c 3\maxclients\16\
208: 6672 6167 6c69 6d69 745c 3430 5c74 696d fraglimit\40\tim
224: 656c 696d 6974 5c32 305c 7361 6d65 6c65 elimit\20\samele
240: 7665 6c5c 325c 2a70 726f 6773 5c32 3135 vel\2\*progs\215
256: 3034 5c6d 6170 5c77 6172 7265 6e22 0a00 04\map\warren"..
272: 0802 00 ...
________________________________
10 0.16891 battlezone -> moorea ETHER Type=0800 (IP), size = 74 bytes
10 0.16891 battlezone -> moorea IP D=129.146.86.171 S=129.144.251.14
8 LEN=60, ID=10322
10 0.16891 battlezone -> moorea UDP D=27500 S=27001 LEN=40
0: 0400 0080 0300 0080 0473 6f75 6e64 6c69 .........soundli
16: 7374 2034 3600 0300 0000 0000 0000 0000 st 46...........