First time here? Check out the FAQ!

Ask Your Question
0

What is this RakNet thing ? How do i get rid of it ?

asked Mar 28 '4

dead33Pro7s gravatar image

updated Mar 28 '4

Last time i used Wireshark, when i restricted all internet access with my firewalls there used to be 0 activity. Now a few months later this thing pops up. What is it and how do i get rid of it ? Im concerned that it's getting past my 2 firewalls.

image

image : https://ibb.co/rx8qFkj

Preview: (hide)

1 Answer

Sort by » oldest newest most voted
0

answered Mar 28 '4

Chuckc gravatar image

updated Mar 28 '4

The raknet dissector is a heuristic dissector that has no preferences to specify a port.
It could be a fluke that your traffic matches the weak heuristic test for a match.
epan/dibe ssectors/packet-raknet.c

test_raknet_heur(tvbuff_t *tvb, packet_info *pinfo _U_, proto_tree *tree _U_, void* data _U_)
{
    if (tvb_memeql(tvb, 1 + 8, RAKNET_OFFLINE_MESSAGE_DATA_ID, sizeof(RAKNET_OFFLINE_MESSAGE_DATA_ID)) == 0) {
        /* ID_UNCONNECTED_PING */
        return TRUE;
    }
...


Disable it (Analyze -> Enabled Protocols... -> Search: "raknet") and see if another dissector claims the packets.

Preview: (hide)
link

Comments

now UDP picks them i recognize the 31313 port, i ran it in cmd netstat -nabo but it does not appear so i can't figure out what app is doing this : They are coming from different ips in like 3 countries

306 74.725687   185.17.164.238  192.168.0.24    UDP 75  14349 → 31313 Len=33
dead33Pro7s gravatar imagedead33Pro7s ( Mar 28 '4 )

Is this on a Windows machine? Similar question answered using sysinternals.
UDP Port 889 Broadcast (ip.ttl "Time to Live" only 1)

Chuckc gravatar imageChuckc ( Mar 29 '4 )

Yes Windows10

dead33Pro7s gravatar imagedead33Pro7s ( Mar 29 '4 )

I turned off everything again, blocked all traffic with my firewalls, reseted Wireshark protocols back to default and now it looks like everything is back to normal. No more RakNet packets. The question now is was it just a "fluke" or is somebody spying on me.

dead33Pro7s gravatar imagedead33Pro7s ( Mar 29 '4 )

found this today ... now im more worried : https://youtu.be/LCsX5dZc1kc

dead33Pro7s gravatar imagedead33Pro7s ( Mar 29 '4 )

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: Mar 28 '4

Seen: 312 times

Last updated: Mar 28 '24