Battlefield 2

From Protocolinfo

Jump to: navigation, search

Battlefield 2 is an EA game.

1 Identification
- 1.1 Ports
- 1.2 l7-filter
2 See also

[edit] Identification

[edit] Ports

UDP ports:

1500-4999, 16567, 27900, 27901, 29900, 29910, 55123, 55124, 55215

TCP ports:

80, 4711, 28910, 29900, 29901, 29920

[edit] l7-filter

l7-filter uses the battlefield2 pattern:

^(\x11\x20\x01\xa0\x98\x11|\xfe\xfd.?.?.?.?.?.?(\x14\x01\x06|\xff\xff\xff))|[\x01\x5c].?battlefield2

The first part of the pattern, \x11\x20\x01\xa0\x98\x11, is for gameplay and is based on these traces:

Trace #1
< 11 20 00 01 00 00 a0 98 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60
> 02 c0 13 1f a4 25 f0

Trace #2
< 11 20 00 01 00 00 a0 98 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> 02 b0 f0 bf a5 45 f0

Trace #3
< 11 20 00 01 00 00 a0 98 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60

The next part, \xfe\xfd.?.?.?.?.?.?(\x14\x01\x06|\xff\xff\xff), is for server browsing and information. The last part, [\x5c\x01].?battlefield2, is for account login. It would be useful to know if the last part always occurs at the beginning of connections.