Traffic Analysis Puns

So obviously one of the big complaints about Strive is the length of time it takes just to get into the game, where you're stuck on the "Communicating with Server" screen. There's also been some discussion about that time varying depending on the player's location, with players in Japan seeming to get into the game faster. So I finally got curious enough to do a bit of network traffic sniffing while the game was booting up. Using a tool called Telerik Fiddler, I was able to see what kind of network activity is going on during the "Communicating with Server" screen.

The game makes 127 (!!) HTTP requests to several API endpoints during this period. These requests are all directed at "ggst-game.guiltygear.com", which resolves to an AWS instance in Japan. Being in the US, I have about 160ms ping to this server.

Each request begins with a TCP/IP connection, which takes 1 round-trip (160ms for me). Then it opens a new TLS 1.2 encrypted connection which requires at least 2 round-trips of data between you and the server (160*2=320ms for me). Then there's the actual data request/response sequence that adds at least another round-trip (160ms for me). So in my case, each request takes about 0.64 seconds total, meaning my minimum time to get past this loading screen is almost a minute and a half (0.64*127 requests = ~81 seconds).

That is purely a minimum time based on the latency due to my distance from the server. The actual time will be higher because the server needs to actually process the requests and probably retrieve the data for the response from a database of some sort. It could also take longer to respond if it's under heavy load.

Part of the problem is each request is made one at a time, waiting for the previous one to complete before starting the next one. If the game fired off multiple requests together, that could cut the load time, but at the cost of more load on their servers.

So what are all these requests doing? Here's the endpoints being hit:

• /api/sys/get_env - Seems to just return the URL to the API (https://ggst-game.guiltygear.com/api/) Maybe future-proofing if they want to load-balance users to other API servers at some point?
• /api/user/login - Returns your Steam username and SteamID
• /api/statistics/get (called 83 times with different request values) - This returns various JSON payloads containing all kinds of data about your game records. Some snipp

Survey Link Here

Hi everyone! My name is James and I am a urban design student at the University of Waterloo. I am here looking for students (or anyone for that matter) from the City of Brampton, preferable Bramalea (but we aren't too picky) to participate in a survey for class. The survey should take less than 5 minutes and looks at understanding traffic flows within Brampton.

My team and I are working in partnership with the City of Brampton to collect and analysis this data. The goal of this survey is to get a better understanding on motorized traffic flows and circulation specifically in Bramalea. Your feedback will help the City of Brampton make real improvements to traffic conditions within Bramalea and surrounding communities.

If you have any question please reach out to me at tcsalyaj@uwaterloo.ca

I would really appreciate if anyone could fill out the survey!

Thank you for taking the time to read this,

James,

University of Waterloo Urban Design Student

https://link.medium.com/QzTPyfbd5gb

I'm currently using Tor over VPN in hopes it would help me stand out less, would that be good enough to prevent traffic analysis from figuring out I'm using Tor? And would using a bridge like OBSF4 help much with this?

https://rad-infosec.ca/f/malware-traffic-analysis-with-wireshark

BIG UPDATE [LIKELY SOLVED]:

As a /u/bojack1437 pointed out here, there are invalid IPv4 checksums indicating a hardware issue. Further checking lead to me isolating that every time a log entry came up, it was from a single switch. I'm going to replace the switch in a separate building and replace fiber optic modules with some spares. Unfortunately it's unrealistic to replace the fiber themselves. I'll monitor for further issues, but I suspect this is entirely a case of faulty hardware of my own and NOT of Reolink.

This is a continuation of this thread trying to figure out what unusual blocked traffic is coming from my Reolink devices.

I want to point out right now, very clearly, that I am NOT accusing Reolink of being up to no good. I AM not a network security engineer. I AM trying to determine if this is entirely an error on my part or other compromise I hadn't considered. I did NOT stay at a Holiday Inn Express last night.

I used a mirror port on my managed switch and monitored the entire Camera VLAN (ID 3). Any network frames that are on VLAN 3 (so every Reolink device on my network) are sent out of another switch port to be logged. The traffic is then received on a Linux server using tcpdump and saved to a packet capture file after filtering out any specified traffic. I filtered out ARP packets and traffic with the NVR (10.1.3.20) as the destination, reducing the packet capture file size from hundreds of GBs to under 100MB over a 12 hour period. Future packet captures will have better filters as needed to further reduce expected traffic and not filter out some traffic we may want to see.

The following packet capture was taken over about a 12 hour period and includes a few things I am questioning and I am a novice when it comes to making sense of the packet info outside of a quick glance summary, so help and input is appreciated.

http://v1uhoh.com/cams-filtered.pcap

Here is the ACL log entry that pointed me to the first highlight:

Feb 16 06:57:36:W:ACL: ACL: List cam-v4 denied 134 10.0.1.25()( v3 ec71.dbcc.794a) -> 74.1.7.156(), 1 event(s)

You can find this specific packet at number 117126. It is determin

I want to monitor street traffic for statistical purposes (i.e. traffic analysis as crossroads). I need to process video and

• read license plates (in daylight)
• detect vehicle type (like bus, lorry, car)

Do you know

• either a software (including commercial)
• or a library/service for this purpose
• or documentation/walk through how to set it up

I have programming skills but limited experience in image processing.

Any hint how to start would be helpful.

Sample shot from video (it's just a sample and in real scenario both angle and light conditions could be improved)

https://preview.redd.it/zwxa40aelss61.png?width=2460&format=png&auto=webp&s=23b262ae0a24efe6fa696d85fec5ad8cc1dfa001

Is there any tools that give a 'somewhat' or perfectly accurate data on website traffic of our competitors ? Just for the sake of testing - While my website gets around 300 -350 visitors per month according to google analytics data , some of the competitor web traffic analysing tools shows it as in between 50 -100 ! so how can I get an Idea about my competitors if I use that tool ? ...can someone suggest any tools for competitor traffic analysis :-)

Hi all,

I am completely stumped with the above. I have reviewed the web.pcap for a few hours now and I am getting nowhere. Please can someone put me out of my misery?

The question is to find the 3rd URL visited. I have found an IP of 93.88.93.99 ( I do tink this is the 3rd URL from the http.request filter) I have enabled Enable network name resolving. BUT nothing. I am loosing it haha

can anyone advise if they have completed this?

thank you all

I recently applied for a job that listed "network traffic analysis skills" as a requirement. I was a little perplexed by what this means and tried googling it. I see a lot of links to products to network analyzers, but nothing related to skills.

Was curious if anyone could offer any insight or had any good resources that may help me understand what Im missing. Any information is appreciated. Thanks.

Survey Link Here

Hi everyone! My name is James and I am a urban design student at the University of Waterloo. I am here looking for students (or anyone for that matter) from the City of Brampton, preferable Bramalea (but we aren't too picky) to participate in a survey for class. The survey should take less than 5 minutes and looks at understanding traffic flows within Brampton.

My team and I are working in partnership with the City of Brampton to collect and analysis this data. The goal of this survey is to get a better understanding on motorized traffic flows and circulation specifically in Bramalea. Your feedback will help the City of Brampton make real improvements to traffic conditions within Bramalea and surrounding communities.

If you have any question please reach out to me at tcsalyaj@uwaterloo.ca

I would really appreciate if anyone could fill out the survey!

Thank you for taking the time to read this,

James,

University of Waterloo Urban Design Student

I'm currently using Tor over V*P_N in hopes it would help me stand out less, would that be good enough to prevent traffic analysis from figuring out I'm using Tor? And would using a bridge like OBSF4 help much with this?

Thanks in advance (: