Being detected?

Zakalwe · Post by **Zakalwe** » Mon Dec 02, 2002 7:50 am

Hello, I was wondering iof when verant portscan you, can they detect Macroquest running?
Also if I write a bot type macro, that takes in commands via tell from a specific player ie, <player> tells you cast <spell> <target> etc. How detectable is this, and is this considered against the spirit or abuse of Macroquest?

I am very interested in using macroquest to run my 2nd account. I currently have 2 computers linked via a KVM switch and switching the display between them takes a few seconds due to resolution differences. It would be nice to be able to macro the regularly used commands such as follow, spell casting , sit and stand etc to the 2nd account.

I dont see this as an abuse per se, as I am still controlling both characters, nothing is really automated. Just making things easier for me. but i would be VERY upset if i were to lose my accounts over something like that...

Malachi · Post by **Malachi** » Mon Dec 02, 2002 12:06 pm

First off, no. Second off, such a macro already exists. :)

Third off, and I dunno if you live in America or not, but it would be *extremely* illegal for a non-government agency to portscan you and then take *any* action regarding what they found.

Sure, they're a private entity and can cancel you at any time. But, if they say something like "upon checking your ports you were determined to be running illicit software which is not permitted by our EULA, and your account will be terminated..." You could sue their pants off and wind up owning a little chunk of Sony.

The burden of proof is on them, see, and your "service" on that port is rather arbitrary. Sniff yourself and see what you're running while on EQ and EQW and MQ by going to start/run/winipcfg -s or just open a command prompt and type winipcfg. Now you see what they can see.

The reason they can't really rely on portscanning is because there are just toooooo many ways to see who's scanning what and to close what's open. If you're like me, you're stealthed and firewalled so sony thinks your IP is 192.168.1.100 , which isn't a level one IP anyway. With that said, yes, I know that GM's scan ports all the time, I'm surprized people don't DoS the IP that's sniffing them. I think I would.

Yeah, I'm angry today. I think it's these damn finals.
Good luck and happy macroing.

~Malachi

Domosan · Post by **Domosan** » Tue Dec 03, 2002 12:29 am

They aren't dumb enough (anymore) to say they are banning you based upon information gained in a port scan. But since your service is at will, they don't have to give a reason, they can ban you because they decide they don't like your character's name.

Domosan

speedphreak · Post by **speedphreak** » Tue Dec 03, 2002 10:53 am

Hmm, quite a bit of misinformation;

Firstly, SOE will not scan your machine - it would really serve no purpose for them to do so, and as stated here would leave them wide open to litigation. They require no 'burden of proof', read your EULA.

SOE do NOT think your IP address is 192.168.x.x (the term for this kind of address is private, not tier 1). They send the packets back to your machine (or router/firewall) and so know exactly what your IP address is on the internet. If you are using some kind of NAT then you're correct they wont be able to scan your game machine, just your router/firewall.

Saying that GMs scan ports all the time is utter rubbish - show us your logs and then we'll see what SOEs laywers have to say about them. The reason people don't DoS an IP 'sniffing' them is because you can't detect someone upstream 'sniffing' you. I presume you mean scanning instead of sniffing - the reason you don't 'DoS' someone scanning you (apart from it being illegal in most countries) is that scans can be easily spoofed. It is trivial to forge a scan from another (innocent) IP address - which with your suggestion would cause your machine to launch an attack on them. You'd be the one getting your local law enforcement agency knocking on your door if someone thought it would be funny to set you up.

Speedphreak

Malachi · Post by **Malachi** » Tue Dec 03, 2002 12:32 pm

Instead of winipcfg you type netstat -s if you wanna see what all you're connected to.

I dunno if soe has ever scanned me :) but people on here say that GM's have done it to them cuz their software firewall has screamed at them. I dunno.

SoE knows my IP, but they can't traceroute from the server I'm connected to, and if they tried to scan from a different box they'd get that it's not there. :) Besides, like you said, they can only scan my router/firewall cuz it won't let tha packets thru.

I had sorta forgotten about spoofing during scans, I'm just used so occasionally opening my logs and watching the literally *hundreds* of kiddies who scan my companies cable IP's...lol, you can traceroute them back to a node in the same town. hehe.

And, like Domo said, and like I said in my first post, since they're private all they have to do is say they want you gone and you're gone.

So yeah, I wasn't real accurate or specific. I was grumpy tho. Anyone wanna come take a bunch of finals for me?

Anyway bro, you're safe, don't worry about your macro.

~Malachi

lifewolf · Post by **lifewolf** » Fri Dec 13, 2002 11:15 am

Need someone to DoS all the EQ servers so all the noobs go away and EQ will no longer suck as much.

That or somehow break all expansions besides the old world so the word 'Economy' wont always be presented with that little dash (negative sign) infront of it.

fantasy world-economy = EQ

Fippy · Post by **Fippy** » Fri Dec 13, 2002 11:23 am

Wow image if your expansion broke and you get busted down to 50 from 65. That would be baaaad.

Being detected?

Being detected?

Eh.

I mistyped a little.