Linux battlefield vietnam servers not listed on ASE

Mon Mar 29 22:34:33 EST 2004

We've been asked to look into why our BFV servers aren't listed
on your ASE browser. From tracing the packets looks like its a bug
with the master at your end. Below is a packet dump of a linux BFV
server reporting to the master:
00:38:59.971393 yoda.multiplay.co.uk.27123 > eye.edome.net.27900: udp 16
0x0000   4500 002c 4116 0000 4011 cd0d d487 dbb2        E..,A... at .......
0x0010   c2fb f967 69f3 6cfc 0018 9ed4 5c68 625c        ...gi.l.....\hb\
0x0020   3237 3132 335c 6266 3139 3432                  27123\bf1942
00:39:00.064432 eye.edome.net.27900 > yoda.multiplay.co.uk.35433: udp 16
0x0000   4500 002c 2205 0000 2d11 ff1e c2fb f967        E..,"...-......g
0x0010   d487 dbb2 6cfc 8a69 0018 6884 5c65 6368        ....l..i..h.\ech
0x0020   6f5c 3136 3534 3337 3836 3234 0000             o\1654378624..
00:39:00.064533 yoda.multiplay.co.uk > eye.edome.net: icmp: yoda.multiplay.co.uk udp port 35433 unreachable
0x0000   4500 0038 4117 0000 4001 cd10 d487 dbb2        E..8A... at .......
0x0010   c2fb f967 0303 057f 0000 0000 4500 002c        ...g........E..,
0x0020   2205 0000 2d11 ff1e c2fb f967 d487 dbb2        "...-......g....
0x0030   6cfc 8a69 0018 0000                            l..i....
00:39:11.327557 eye.edome.net.27243 > yoda.multiplay.co.uk.23000: udp 10
0x0000   4500 0026 61ab 0000 2d11 bf7e c2fb f967        E..&a...-..~...g
0x0010   d487 dbb2 6a6b 59d8 0012 9743 fefd 007e        ....jkY....C...~
0x0020   372a 00ff ffff 0000 0000 0000 0000             7*............
00:39:11.327648 yoda.multiplay.co.uk > eye.edome.net: icmp: yoda.multiplay.co.uk udp port 23000 unreachable
0x0000   4500 0038 412f 0000 4001 ccf8 d487 dbb2        E..8A/.. at .......
0x0010   c2fb f967 0303 38a7 0000 0000 4500 0026        ...g..8.....E..&
0x0020   61ab 0000 2d11 bf7e c2fb f967 d487 dbb2        a...-..~...g....
0x0030   6a6b 59d8 0012 0000                            jkY.....

As you can see the server is reporting but instead of the query being
sent back to the listed port, in this case 27123, its sent to 35433 and
23000. The server isn't listening on said ports so no response is
sent and the server isn't listed.
A BF1942 server does the same but for some reason the master
after trying 35433 and 23000 also queries the source / specified
port e.g.
00:53:51.005642 yoda.multiplay.co.uk.27224 > eye.edome.net.27900: udp 16
0x0000   4500 002c 46c9 0000 4011 c75a d487 dbb2        E..,F... at ..Z....
0x0010   c2fb f967 6a58 6cfc 0018 9c6f 5c68 625c        ...gjXl....o\hb\
0x0020   3237 3232 345c 6266 3139 3432                  27224\bf1942
00:53:55.540368 eye.edome.net.27243 > yoda.multiplay.co.uk.27224: udp 1
0x0000   4500 001d ecfe 0000 2d11 3434 c2fb f967        E.......-.44...g
0x0010   d487 dbb2 6a6b 6a58 0009 4b7a 7373 0000        ....jkjX..Kzss..
0x0020   0000 0000 0000 0000 0000 0000 0000             ..............
00:53:55.546308 yoda.multiplay.co.uk.27224 > eye.edome.net.27243: udp 816
0x0000   4500 034c 46db 0000 4011 c428 d487 dbb2        E..LF... at ..(....
0x0010   c2fb f967 6a58 6a6b 0338 84b8 4559 4531        ...gjXjk.8..EYE1
0x0020   0762 6631 3934 3206 3237 3130 3120 4d75        .bf1942.27101.Mu
0x0030   6c74 6970 6c61 792e 636f 2e75 6b20 3a3a        ltiplay.co.uk.::
0x0040   2054 4553 5420 436c 616e 7365 7209 636f        .TEST.Clanser.co
0x0050   6e71 7565 7374 0961 6265 7264 6565 6e05        nquest.aberdeen.
0x0060   7631 2e36 0230 0230 0332 340c 6163 7469        v1.6.0.0.24.acti
etc

As the query port is sent in the heartbeat packet I don't see why the
master is not using this information and querying it directly first,
instead of 35433 and 23000 first then the query port in the case of
BF1942 ( success but causes needless traffic ) and exclusively 35433,
23000 in the case of BFV ( failure and also needless traffic ).

N.B. I'm lead to believe the BFV server incorrectly sends
\hb\<port>\bf1942 instead of something uniq e.g.
\hb\<port>\bfv

Finally a windows server BFV seems to get a correct response
without queries to 23000 or 35433 but Im unsure if that's due
to the OS hiding the icmp details from ethereal / winpcap
vader.multiplay.co.uk:15690 -> eye.edome.net:27900
0000  00 c0 7b c0 85 d3 00 20  ed 6e 52 85 08 00 45 00   ..{....  .nR...E.
0010  00 2c d0 45 00 00 80 11  fd dc d4 87 db b3 c2 fb   .,.E.... ........
0020  f9 67 3d 4a 6c fc 00 18  ca 77 5c 68 62 5c 31 35   .g=Jl... .w\hb\15
0030  36 39 30 5c 62 66 31 39  34 32                     690\bf19 42 
eye.edome.net:27900 -> vader.multiplay.co.uk:15690
0000  00 20 ed 6e 52 85 00 c0  7b c0 85 d3 08 00 45 00   . .nR... {.....E.
0010  00 21 3d 45 00 00 2d 11  e3 e8 c2 fb f9 67 d4 87   .!=E..-. .....g..
0020  db b3 6c fc 3d 4a 00 0d  1b b9 70 52 8e e2 ce ce   ..l.=J.. ..pR....
0030  00 00 00 00 00 00 00 00  00 00 00 00               ........ ....    

If you need any more information on this dont hesitate to ask
either via email or you can find me on IRC in #mpukhosting
on QuakeNet.

    Regards
    Steve / K
    Multiplay Clanservers

================================================
This e.mail is private and confidential between Multiplay (UK) Ltd. and the person or entity to whom it is addressed. In the event of misdirection, the recipient is prohibited from using, copying, printing or otherwise disseminating it or any information contained in it. 

In the event of misdirection, illegible or incomplete transmission please telephone (023) 8024 3137
or return the E.mail to postmaster at multiplay.co.uk.