How to extract information from client/server communication with no documentation?

Question

What are methods for undocumented client/server communication to be captured and analyzed for information you want and then have your program looking for this information in real time? For example, programs that look at online game client/server communication and get information and use it to do things like show location on a 3rd party map, etc.

Answer 1

Wireshark will allow you to inspect communication between the client-server (assuming you're running one of them on your machine). As you want to perform this snooping in your own application, look at WinPcap. Being able to reverse engineer the protocol is a whole other kettle of fish, mind.

Answer 2

In general, wireshark is an excellent recommendation for traffic/protocol analysis- however, you seem to be looking for something else:

For example, programs that look at online game client/server communication and get information and use it to do things like show location on a 3rd party map, etc.

I assume you are referring to multiplayer games and game servers?

If so, these programs are usually using a dedicated service connection to query the corresponding server for positional updates and other meta information on a different port, they don't actually intercept or inspect client/server communciations at realtime, and they don't really interfere with these updates, either.

So, you'll find that most game servers provide support for a very simply passive connection (i.e. output only), that's merely there for getting certain runtime state, which in turn is often simply polled by a corresponding external script/webpage.

Similarly, there's often also a dedicated administration interface provided on a different port, as well as another one that publishes server statistics, so that these can be easily queried for embedding neat stats in webpages.

Depending on the type of game server, these may offer public/anonymous use, or they may require certain credentials to access such a data port.

More complex systems will also allow you to subscribe only to specific state and updates, so that you can dynamically configure what data you are interested in.

So, even if you had complete documentation on the underlying protocol, you wouldn't really be able to directly inspect client/server communications without being in between these communications. This can however not be easily achieved. In theory, this would basically require a SOCKS proxy server to be set up and used by all clients, so that you can actually inspect the communications going on.

Programs like wireshark will generally only provide useful information for communications going on on your own machine/network, and will not provide any information about communications going on in between machines that you do not have access to.

In other words, even if you used wireshark to a) reverse engineer the protocol, b) come up with a way to inspect the traffic, c) create a positional map - all this would only work for those communications that you have access to, i.e. those that are taking place on your own machine/network. So, a corresponding online map would only show your own position.

Of course, there's an alternative: you can emulate a client, so that you are being provided with server-side updates from other clients, this will mostly have to be in spectator mode.

This in turn would mean that you are a passive client that's just consuming server-side state, but not providing any.

So that you can in turn use all these updates to populate an online map or use it for whatever else is on your mind.

This will however require your spectator/client to be connected to the server all the time, possibly taking up precious game server slots.

Some game servers provide dedicated spectator modes, so that you can observe the whole game play using a live feed. Most game servers will however automatically kick spectators after a certain idle timeout.