Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While doing a casual packet capture I happened to notice an infrequent, yet constant stream of UDP packets. The packets in question contained the following:

Destination-port: 20060

The packets seemed to also randomize the source port.

What's really creepy though is the ASCII in the Packet data which reads:


Anyone have any clue what this is coming from?

Also is this the right place for such a question?

share|improve this question
Random ports? That sounds bad (well usually, unless you are using a P2P program). Do you play EverQuest? – Synetech Nov 19 '12 at 1:39
@syntech Nope. The plot thickens. :| – randomPrime Nov 19 '12 at 1:40
You said that you noticed it while sniffing packets; what process was making the connection? Have you checked for auto-runs and running processes in the Task Manager yet? – Synetech Nov 19 '12 at 1:42
If this is a windows box, you can use netstat -p udp -anb to figure out the process sending the udp packets. Cross reference with Tast Manager process tab, after you enabled PID in the view/columns options. – Paul Nov 19 '12 at 2:46
@Synetech I just figured it out; It was a Planetside 2 client I had running in Wine (Wine Is Not Emulation); I guess this is some form of DRM – randomPrime Nov 19 '12 at 2:52

Actually it's the content server, to download the game, which it tries to reach (in vain currently, as there seems to be a problem). It retries in 10 seconds interval. Might additionally also be the lobby mechanism though.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .