Fixing Disconnects with Call of Duty: Modern Warfare

[Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] [Music] you can you hear this so this is not my it's not this microphone I I just turned on them I turned on the microphone that's on the camera that's built into the camera I'll figure this out later as long as you can hear it even though it's not up to my personal standards of audio quality let's just move along so okay thank you for joining the second that has gone perfectly so far pakad BOM livestream experience I've got my coffee in my networking with fish mug I met her at shark fest a few years ago I think she came to the shark fest and attended my session and gave me a mug and I use it almost every day there's no bourbon in here so where are we from I moved this earlier on a Friday hey pink ash how's it going buddy our people from Europe is this you know able to join I hope it's after work and you know maybe Europe sipping a beer or something where's my chat window I guess I can just look at it from Austria very cool there's lots of clipping clipping and crackling I really wish I knew why the other mic isn't working it's enabled in Windows I checked it's selected as input and I see the meter moving in Windows but in OBS the meters not moving it is enabled it's not muted I turned off discord okay some crackling you know what lesson learned I honestly didn't check that my audio was working before I started that's shame on me shame on me I should have done that so input yeah I mean it's you know what I it worked perfectly last week I did not change anything that I know what changed no nothing changed well sir the applications not working anymore something must have changed all right so anyway got my coffee last week we have it so if you are watching this in the future the replay sorry about all that today we're talking about call of duty and it not working I imagine there's a bunch of children who might find this video in the future look in the description there'll be a link to go straight to the the packets okay but for all of us we're here in the moment and we can't skip forward as much as I wish I could go back and and redo all that so alright I got my coffee I hope you guys that are across the pond I've had a great work week and maybe sipping a beer ready to talk about some packets it's yeah 9:42 in San Francisco I got my roll out of bed threw on a shark fest shirt I got a stack of them my kid is listening to me on her iPad behind me why I mean I'm right here but she's watching it on her iPad maybe she'll learn some stuff about packets so let's let's move on here's my website networking with fish you should check her out she gave me this mug she was a networking person she talks a lot about troubleshooting good stuff I highly recommend it so update on the PCs we talked about last week I showed you guys last week my setup I have let me find her let me bring it up real quick the picture that I showed you guys this-this-this submit it know submitted this okay so--that's oh let me this is my setup my new PC that I built this desk is gone I have a new desk I haven't taken a new picture we talked about this last week don't look now at the bottom the cable management there are reasons for that so update I the the built-in CPU cooler that comes with the Rison AMD you know processor it was it's like 80 millimeters or something my case fans are like 140 and there's three of them are 140 and one of them is 120 and it was I could hear it spinning up and spinning down all the time it was it was just too much and they bring up the chance so I don't miss everything you're saying my daughter's in the chat cool so I got one of these guys only for the quiet aspect right not because it has an LCD screen and you pay a premium for that that is definitely not the reason but I did I did add this I made this little thing I'm learning and teach myself DaVinci Resolve and I made this little neon sort of the animated gif to put on it that's fun right cool so let me check my list okay so hope everyone's doing okay um you know we've been through a lot so far this year is a lot going on I hope everyone's safe and healthy and yeah prayers for everyone's safety and change and everything that needs to happen so it's a rough time right now so I hope you're all doing well so we're gonna talk about another application problem last week we talked about you know two vendors arguing with each other because an application wasn't working and then when they couldn't pin it on one another they went to the network and then the network dude Fidel who sent me the case study was able to demonstrate in the packets actually no it's this guy's fault and so that's an application problem you're looking for something that is broken and trying to understand why it's broken this right so that's one type of problem we're gonna look at another one of those today and next I think we will probably start to get into maybe performance right because it performance necessarily is it broken you're not looking for like a reset or something that causes an application to be broken we're looking for why is this not performing as expected and those can be a little more nuanced a little more tricky gets more into TCP behavior so I think in our next one next week we'll start to look at some performance issues if I can figure out since I have failed with the microphone I now doubt my ability to do it but I would love to be able to bring in guests and have some guests to talk about some things my buddy Chris who's on the networking subreddit did an awesome analysis of a audio streaming issue so I mean we can look at that one hopefully he'll come on and talk about it if not you know I guess I can do it but he's a fantastic Network analyst and he's got some awesome case studies not Chris Greer Chris also my buddy also very cool Chris I think it's like Margot or Margaret are mark Mars yet I'm not really I don't remember exactly but Chris he's been a part of networking filled day he's taking part of some of those things he has a website called fragmentation now that's probably not right Chris no I've completely failed completely filled once again I'll find it that's probably not his last name Chris oh he had a awesome case study about mold UDP fragmentation that was right this is one of the best case studies I've read I think he does the whole thing by packet analysis and doesn't even use Wireshark that's how good he is so check this out if I can get him on I'd love to we'll see so yes performance things maybe we can look at some other tools I'm happy to hear from you guys about content someone asked about TLS someone asked about SMB I can put those on the list we can look at some protocols there's a new tool that's recently come out I think it's called bream so that's the name of the company is the is the tool called bream to but it's a free tool no it's called broom this looks very cool and I would recommend you check it out watch types of demo last night a couple of guys I used to work with are here at this company this looks like a cool tool so I need to get used to use it a little bit understand it a little bit better but it looks it looks really cool so with that said oh I did put the the pcap someone last week asked if they could download the peak apps and follow along so I think I hope in the description wait is it yes in the description you can download the peak app that we're going to look at ok and follow along if you want so with that said now that we're 20 minutes in Oh so Laura Chapel did a webinar about brim that's great yes so if hopefully that's on line like I said I haven't used it yet but it looks it looks really cool okay so alright so today's problem I you know I hang out sometimes in the Wireshark subreddit and there's a lot of kids coming in asking about IPs and Xbox and how do I pull my peas from the lobby how do I you know and I don't know I assume they want to do something stupid or I don't know but this one the fact that he had the words capture analysis okay and I started reading and I was like you know what I'm gonna try to help this kid because he's clearly putting in the effort to understand a problem that he's having in his home network in Ostia when people come to me with like home network problems it's like oh you know for one most of my experience is more in a enterprise environment not that that matters necessarily but I mean just you know home networks or like you never know what you're gonna get and I didn't have a lot of confidence that I would be able to really find anything you know half the time you look at and go yeah I think maybe you've got packet loss somewhere you know maybe maybe your internet connection is nothing good it can be tough to pin things down when you have very limited visibility into what's going on so what this I say kid I don't really know I I'm making assumptions this I don't mean to be disparaging he has a router that he's able to take a peek app on and that's where he took it so he took the peak app on the router not on his PC because well apparently if you try to run packet capture software while you're running some of these games like Call of Duty it will crash it's like an anti cheating mechanism so I have learned so he took a pee cap he says that the problem you know he gets disconnected I said you know what let me see if I can help this kid so and I talked about this last week but you know ideally before you start looking at a problem looking at data make an effort to capture data you need to understand it as best as you possibly can ask a lot of questions drill down get specific because Wireshark is a specific tool right it's it's a precision tool a scalpel whatever you want to call it you're looking at individual packets so if you can be easier you can whatever ways you can to narrow down a problem it's gonna save you work in the long run so spend as much time as you can up front asking questions drilling down narrowing down so that when you're ready to look at data ideally you've already got a head start so I asked some questions do you have any other application issues outside of this game do you get problems with other games what about websites that loading are they slow does it happen every single time or only sometimes does it happen like at the same point every time or at different points if you start the game time zero does it happen every time at twenty seconds five minutes whatever is it consistent and then can you send me the data so we answered these I don't believe him in some of these necessarily but he's I don't have any other applications but for some reason I can't connect to Google related websites for a few minutes after I start about okay that's oddly specific but weird okay follow that one away he's definitely got some other problems I don't have connection issues with any other game websites are fast it happens every time I play but the time it's happens varies right so he included the peak app on mega which I think I had to create a ton account to download so I put it up on Dropbox for you guys I didn't I didn't anonymize everything I mean he put it up here for everyone to see so that's it all right so Wireshark let's make it is that too much Vaughn gets really weird it's fine alright let's put this align Center so this is last week we talked about configuration how to set up wireshark from scratch I haven't come close to setting all the things I normally have in my default profile that I have built over the years I think if you do this all the time it's good to have you know a default profile for you and profiles for different kinds of issues and troubleshooting you know something focused on IP something focused on TCP something focused on HTTP and it depends on you know the kinds of things you look at for me I don't do this that much so I make changes as I need to make them and then that's what I do so I've made the changes that I need to make last week and this is where we left it right ok so he sent me this pcap he's got some IP data and the thing that will be good that we will reference just to get an idea of what we're looking at you know this is only about a minute 59 seconds we've got almost 9,000 packets okay and then I want to see okay well like I'm assuming he has an unfiltered capture of all the traffic that is hitting his router right if something doesn't go to his router we're not going to see it so potentially we're trying to have a pretty big blind spot about what's going on in his network if we're able to figure this out so looking at conversations at the just the IP layer we've got a hundred and seventy different IP conversations IP pairs all right there's a good bit IP v6 going on on his network and we've got a hundred and sixteen TCP connections and 200 UDP streams okay so if we look at his post his IP is 0.54 dot ones his router and he's got a couple of IPs that he thinks are related to call of duty which Blizzard I guess is the company that makes it daemon where is another company involved I may have played a little bit of Call of Duty but I don't really know that much so why don't we just filter on his IP as a place to start see what's happening so IP a derp equals one ninety two dot one sixty eight dot zero dot fifty-four okay and let's just kind of see what's happening he makes the connection right off here at the beginning to with a thirty seven address now most of the time I don't really I don't want to see I don't want resolve network names and IP but for now I'm gonna turn it on because it might it might help me instead of having me to look up all these IPS to see what they might be maybe some of them will resolve and it'll be convenient name resolution network address I just turn that off because nothing changed I did okay well nothing changed fritzsche box I thought these had changed before but we can look it up right for good IP and destination right click copy value and do I have a thing open already I guess I don't I'm hey look up okay this is Blizzard so yes and maybe this is the one he actually even told us about I'm still here right yeah things seem to be slow 37:54 10 yeah so that's what he thinks is an authentication or server some babies right good for him okay so clearly we're talking to it we're talking to his router fritz box is the 0-1 address his router just scrolling to see what's happening here right it's talking to Nvidia we were talking to battlenet that one does sound familiar I think that is some sort of game server for Call of Duty right again everything seems to be okay one thing I did well we'll come back to it I thought I'd noticed you know if this is his local router right he's on the PC connected to it you know there is some traffic between his PC and the in the router and I thought that's like a 48 millisecond trip time between the two which seemed not great but all right login Q so this is maybe connecting to a you know a game server or the lobby thing where you get connected to other players more Demonware IP addresses but you know it's it's doing its thing I'm not gonna single one off do PACs or something I'm not gonna really spend a lot of time on those but I'm just going to see what it looks like what is it doing we do have a ping request timeout this is two Akamai from his PC you don't know what that's about but I think the TTL is one so yeah that's not gonna go anywhere don't know it's not a problem I don't know but again when you're looking at this we're looking through the data you're not you know you're just looking for things our brains our pattern recognition engines that's what they do the more you do this the more your brain is wired to recognize patterns in this data so when people like bring up Wireshark and they're not familiar with it it's just all overwhelming because their brain hasn't been wired to see patterns through experience and effort so it just takes time and as we're going to see in this you also need some networking knowledge probably traceroute yeah that's it that's a good point very well could be all right so we're gonna start going a little faster still talking to a lobby demon where don't really see any problems jumping out at me okay now we're hitting UDP traffic to a bunch of different IPs again I've never looked at Call of Duty traffic or anything like that you know maybe this is now talking to all his peers maybe this is the thing that the kiddies are always after what are they piece of that guy he was mean to me maybe that's what that is but there you go and now they're talking back to him maybe they're just checking in to say hi and then yeah a lot of UDP 30 74 and I'm pretty sure if I google that it's gonna show up as this game traffic we're gonna go a little faster again I'm just looking for things that pop out to me clearly we're chattering back and forth and now a big stream of UDP data to one IP address which we could look up and this probably a game server so we're communicating sending our data maybe he's playing right now maybe he's shooting people and we're getting towards the end so we haven't seen any problems so I mean potentially we could have just zoomed to the bottom and looked for a problem but you know it's not a bad idea to get a lay of the land all right now we're back to talking to the lobby maybe his games over or maybe that's just how the application works and we do start seeing retransmissions which I believe he talked about again the person clear doesn't know that much about networking but kudos for giving it a shot and he he did see that there were retransmissions and his computer didn't seem to be acting and that's that's what a retransmission is it doesn't get act so it sends it again so let's let's drill into this a little bit and we clearly have some this is TCP on so this is TCP 30 74 right instead of UDP 30 74 and we're going alright now that we kind of got a feel for the IPS let's turn that back off now what I'm curious what I'm always curious about when I'm looking at something like this is where we are in the byte stream right because we're sending data the server sending data and then you it's two ways duplex right and so you're having to act what you're receiving and you're having to receive acts from what you've been sent so I like to get an idea of where we are and that little dance and that's why I like to include sequence number as a column next sequence number as a column and act as a column so they don't take up too much space we'll just call this as EQ and this one we'll call em XT seq and this one will be back so you don't have to add this you can look down at the packet details but for me if I'm trying to follow a byte stream right TCP it's job is to transfer bytes it doesn't care what those bytes are what application they are its job is just to transfer bytes make sure that they all get there and that's how that's what the sequence numbers are for this is where this marks where you are in the byte stream and what has been acknowledged so we are let's say let's look at let's come up to like right here this is the server sending to us 98 bytes of data TCP data right so you take the current sequence number you add the TCP link to it you get what the next sequence number is expected to be if you come to the next packet from that IP it should match so this column should match this column in order the acknowledgement number says okay well I've received all the data 1 6 8 9 9 4 up to and including 9 94 and the next sequence number I expect is 8 9 9 5 which is this one so that means we're all it's it's acting this immediately right and here's what I was talking with that round-trip time right so this was received this went out the router interface to the local PC 40 milliseconds later it got acknowledged that's low that's the land I mean it's not a problem it just doesn't sound very good to me right so that data is all acknowledged he sends another packet with the next sequence number of Oh 2 4 5 we acknowledge it right here so these match and he sends oh he's acknowledging data 3 2 2 7 8 he's acknowledging I think this packet up no not that packet one of these other packets this one he's acknowledging this packet it has data in it so we this is the last time when we send data to the server right that's 1202 bytes and so he is acknowledged that it's no data he's just acknowledging that packet up there then he sends 322 bytes of data no acknowledgement which you know with TCP sometimes we don't act every packet right we might act every other packet how that behaves exactly depends on the TCP stack but I'm not gonna get too upset because I don't immediately get an act from a single packet however 375 milliseconds to go by and we don't see anything and we see this same packet the same TCP sequence numbers so Wireshark says hey we already saw that one there was no acknowledgement that's a retransmission and we can verify that it's not the same packet as a duplicate by looking in the IP header at the IP ID 3 7 2 6 2 3 7 2 6 3 so that's the next packet and order right so it didn't the server sent data for every bit of data it sends it sets a timer and if that timer expires before it receives an acknowledgment that's a transmission time out and it will retransmit it RTO so it weighted 375 milliseconds we have some other some other TCP stream in here mixed in and actually let's drill down this so we can see this a little better so we're gonna do conversation filter TCP right so here's the data that was sent 375 milliseconds later it retransmitted 760 milliseconds later it sends it again then one and a half second three second six seconds so as a an analyst as a packet person even without the the markings of Wireshark these numbers should trip something in your head right there's something about these numbers and what is it it's doubling every time right that behavior is TCP retransmission for each time it has to retransmit it doubles the timer and you see that back off and eventually eventually it will time out completely but that's the last thing we see on this connection in this so let's just click on like this one and let's go back to our previous filter of just the IP so clear we have our the PC stopped responding right now our job is to figure out is this all traffic just just this connection again we're trying to find a pattern of behavior so if we come down we see a packet being sent five almost six seconds after the this transmission if I set a here let's set the time to since beginning of capture and we're gonna say the last packet that was sent we're going to mark that as a time reference so now instead of starting at zero for this column time since beginning of capture everything that comes after it is using it as a reference point so like 13 no sorry where were we eleven and a half seconds after things seemed to go wrong there is a membership report to a multicast address to a multicast MAC address now I stood up multicast on the network probably 15 years ago so at the time I knew a lot about multicast anyway membership report if I remember correctly is a receiver multicast works in groups is saying hey I care about this multicast group and it reports that to the switch so if the switch receives traffic for that multicast group it knows which ports are members of that group and it'll send the multicast traffic to on that port so it's just saying these are the multicast groups I care about mister switch please send them to me so that's fine I don't think it necessarily has anything to do we feel look probably and see if these are well known multicast groups we could go look that up we have a couple of those more retransmissions we have our router trying to connect to us on port 80 don't really know what that's about we don't answer we don't we don't even send a reset we just ignore it generally if someone tries to initiate a TCP connection to a port you're not listening on you don't have a server running on that port the stack will send a reset back saying no one home it doesn't happen it retransmits a couple of times we get another multicast and we see some data still trying to be sent to our IP no responses so clearly other than this multicast thing we stopped talking so I'm going to go back to the last time we sent this a packet on the conversation and I want to see what else is happening right because this is a wide open capture on the router and we're gonna clear it here's our packet so we have some home plug AV protocol right again home networks you get all kinds of junk all your little internet of things talking to each other and media servers and we have UDP UDP traffic to something else on the network some other tribe whatever this dot 21 is we could probably go look and see but right now I'm not gonna chase that down here was one of the packets sent to our PC here's another one but again not much else and then we get here and this is interesting who has one 92168 0.1 tell one night two oh six eight 0.54 that's an ARP and that is our PC saying hey I need I know my default route right 0.1 the default route I have the IP I need the MAC address and it replies hey here's my MAC address so if you want to talk to me this is where you can find me I assume that the ARP table timed out and it had to refresh it this is Windows terminal which is not bad ARP - a tells you the mapping on my PC mapping the layer 3 address to the layer 2 address remember you have to understand the the networking stack the model OSI if you will the layer 2 address maps to a layer 3 address so for me my dot 1 address is located at this physical address so this will timeout eventually and we will have to ask for it again and it will tell me right so that's what's happening and it replies now when I saw this I go ok this one is definitely a flag for me I don't know if it's something I looked I scrutinized it ok you know we're asking yet for the IP I made sure that the reply was the correct MAC address I couldn't find a problem with this ARP itself but then I got to wondering ok I didn't see that in my previous filter because I was I was filtering at layer 3 on the IP address well this PC is talking at other layers I need to know what else is doing so I'm gonna filter then just on its MAC address to get any traffic that it's sending and this is its MAC address so we will apply as a filter and okay so this again is the the TCP conversation we care about that was happening da-da-da-da-dah is going fine then we ARP and after the ARP the retransmission start big flag but I couldn't find a problem with this arm like well maybe I mean didn't get lost surely but I mean I I guess it could have but wouldn't have just arced again I don't know but something's weird about this so let's go back through now that we're seeing more than just layer three traffic or sorry ipv4 traffic that's what we were filtering on let's go back and have a look again so again we see the membership reports but we now we are seeing some ipv6 from our MAC address and these are DNS queries for Call of Duty stuff right battlenet now I'm not an expert I'm not an expert on this but I'm wondering if Windows if it fails to get a response with ipv4 DNS it will then try ipv6 so do we have an ipv4 problem you know ipv6 doesn't require ARP it has a different protocol so again looking for this I don't see any traffic being sent it's not multicast and not ipv6 from this PC after it arced for its default route and again we're blind because we're capturing the router and not the PC so I said all right what if we just look is this the only guy having a problem I don't know I got curious about what was happening with our traffic and so I did ARP and you know I'm seeing ARP announcements I'm seeing ARP requests and wait what fortuitous ARP for address that we do care about duplicate use now this is Wireshark telling you something this isn't in the packet so what is this so we have a gratuitous ARP meaning it's a reply that no one asks for it's like you know before you can even ask someone how they're doing they just launch into a ten minute tirade of all their ailments and you know things are upset about no one asked for this but someone's sent a reply saying hey this is this is a this is my this is my MAC address this was sent by a tp-link device but it was sent directly to the router it's not a broadcast but it is saying hey this is my MAC this is my IP this is your Mac and this is what you're saying your IP is so you google for tp-link you know it's a network device switches wireless things his router is a fritz box well I don't get me wrong I could not I did not dive into the details of his network topology which I should have honestly the more I know about his setup because clearly it's a little bit complicated he's got lots of devices he's got a router which is he calls the fritz box and he's also got a tp-link device saying I have that IP so what I believe this is because it's not to abroad it's not a gratuitous ARP as a broadcast like something comes up you know on the network and tells everyone hey you can find me here at this this is my opinion this is my Mac or if you have you moving an IP address a layer 3 address to a different layer to address you know like if you move vm's or something fell over happens right between redundant house and you have the same IP well now the MAC address has changed so you need to tell everyone or you need to tell the switch hey this is where you find this this this IP in this Mac now all right those are the kinds of things many times are broadcast this was unicast so I think this is the tp-link saying hey excuse me we seem to have a disagreement here but this is my IP and then you know the the routers like no no no this is my IP so I went back and told him it looks like you have a tp-link device that is configured with the same IP address I don't know what you're using it for what it's there for but you either need to change its configuration for it to stop acting is what you need to change this IP you can't have two devices so what I think happened is we don't have the data is our PC arced for its default gateway and this guy replied first he beat the router and said oh here's it here's a MAC address so from that point on we started sending the traffic to this tp-link device and essentially black holding it it's not going anywhere once he changed its IP the problem went away no more disconnects he's killing people all day and the his weird issues not connecting to sites for the for a few minutes cleared up as well you know what I don't I really use expert info stuff but if you click on this button down here oh man if you click on this button here and just like glanced through it it's like tada what would I have learned so there you go add it as the filter ARP duplicate - address - detected that's that's the that's the coloring rule here I'm pretty sure if we let's go though mine's not showing up as I'm not sure why it's I probably just say in the last video I disabled a bunch of coloring rules no there no it's not I see this packet itself is not colored you could though if you wanted to so this is the the expert info right expert info was just Wireshark trying to be helpful looking at the packets making educated guesses can i what would I do right click on this I click on that No that's it so if you say prepare no copy copy as a filter and you went to coloring rules if you wanted to add it you could say the filter is that and the color is you know foreground blue background red they'll be terrible why is it black oh I didn't ever go that looks terrible and enable it I think that'll work ooh there you go yeah so that's how you could do that if you wanted to call those out I'm gonna I can't my eyes are burning right okay so you know what I didn't expect that we would be able to really figure much out for this kid I had someone else private message me hey can you help me with Wireshark and he hasn't gotten back to me cuz like I said tons of people posts I think they automatically get removed from the Wireshark subreddit at this point and people just ask how to pull I piece so he went did that fix the problem hooray hooray that was fun so next time next week I will fix the audio problems lesson learned shame on me again let me know what you guys want to see shoot me something on Twitter it's it's it's packet bottom on Twitter if you want I put a link for this discord server that I created that I haven't used but I also not have put the link anywhere so no one could obviously join it so I you know I work from home right in today's environment I'm sitting here in front of my computer doing work I check in multiple times a day on discord so if you want to talk packets I'm usually there but you know email works Twitter works yeah let's see dan let's concede this so my buddy Dan who is a bait local who is a packet guy also has chickens I told the story last time but we we Matt had lunch he gave me a dozen beautiful organic pasture-raised eggs which I ate all of them we raised his chickens he can't sell the eggs right now to restaurants as he does and you know anyway he's looking he's watching the live stream and there's a chicken in the way you know I've seen lots of I'm seeing lots of like videos of puppies or cats really that's the first one I've seen a picture of somewhat of their chicken getting in the way anyway so I hope you guys enjoyed that I hope you have a great weekend stay safe let me know what you want to see you know it's it's fun to to do this I like I like trying to help people and solve problems you know I like excuse to set up elaborate expensive AV equipment so you're giving me the reason I'm working on learning DaVinci Resolve because it's free and I hope to actually put out some you know quality produced videos as well well so we'll see how that goes all right guys I'm gonna in the stream but I'll leave the chat open and I'll address any issues I'm sure I missed some issues in the chat so see you next time [Music] [Music] [Music] [Music] [Music] [Music] you [Music]

Channel: PacketBomb

Views: 779

Keywords: wireshark, packet analysis, tcp, networking, cod, call of duty, modern warfare

Id: EczesTnDFZM

Length: 61min 3sec (3663 seconds)

Published: Fri Jun 05 2020