Просмотр

PKT 3.1 — a format of [[PKT]] network packet dump files, successor of [[PKT 3.0]].

The main reason for creating PKT 3.1 is the inability of PKT 3.0 to store multiple World of Warcraft TCP/IP connections in a single RAW file. <ref>[http://ru-mangos.ru/showthread.php?t=4373#post22656 LordJZ says about the inability to store packets from multiple connections with PKT 3.0]</ref><ref>[http://ru-mangos.ru/showthread.php?t=4373#post22659 RomanRom2 says that a new format is needed]</ref>

The spec consists of two file formats that are used to keep decrypted and encrypted World of Warcraft packets, with extensions .pkt and .raw respectively.

== PKT spec ==

Inside a .pkt file, first there goes the main header. It contains general information about the packet dump. After the main header, there are packet stream fragments with headers.

Fields longer than 1 byte use little-endian byte order by default.

=== File Name ===
{|border=1 cellspacing=0 cellpadding=3
|'''Field'''||'''Value'''
|-
|File name||any
|-
|File extension||Always '''.pkt'''
|}

=== Main Header ===

{|border=1 cellspacing=0 cellpadding=3
|'''Field'''||'''Length'''||'''Content'''
|-
|Signature||3&nbsp;bytes||Symbols 'PKT' in ASCII
|-
|Format version||2&nbsp;bytes||0x01, 0x03 for PKT 3.1
|-
|Sniffer ID||1&nbsp;bytes||See [[PKT Sniffer ID]]
|-
|Client Build Number||4&nbsp;bytes||
|-
|Client Language Code||4&nbsp;bytes||i.g. 'enGB' in ASCII
|-
|Session Key||40&nbsp;bytes||Optional. Can be filled with zeros.
|-
|Dump started unix time<ref name="new-in-3-1">New in PKT 3.1</ref>||4&nbsp;bytes||Number of seconds passed since the Unix Epoch (UTC)
|-
|Dump started tick count<ref name="new-in-3-1"/>||4&nbsp;bytes||Number of milliseconds passed since the OS start
|-
|Optional data length||4&nbsp;bytes||
|-
|Optional data||||Length of this field is in the previous field
|}

=== Network Stream Fragments ===

{|border=1 cellspacing=0 cellpadding=3
|'''Field'''||'''Length'''||'''Content'''
|-
|Packet Direction||4&nbsp;bytes||'SMSG' or 'CMSG' in ASCII for S->C and C->S packets respectively
|-
|Connection ID<ref name="new-in-3-1"/><ref name="unixtime2connid">Field "Packet arrival unix time" was replaced with "Connection ID" in PKT 3.1</ref>||4&nbsp;bytes||Packet's TCP/IP connection's unique identifier
|-
|Packet arrival unix time||4&nbsp;bytes||Number of milliseconds passed since the OS start
|-
|Optional data length||4&nbsp;bytes||
|-
|Data length||4&nbsp;байта||At least 4 bytes
|-
|Optional data||||Content of this field is controlled by the sniffer's developer.<br />Length is in the "Optional data length" field.
|-
|Data||||Contains data of one World of Warcraft packet.<br />Length is in the "Data length" field.
|}

== RAW spec ==
''Not Yet Translated''

== Links ==

* [[PKT 3.1|PKT 3.1 spec in Russian]]

== References ==
<references/>