What is Emerald sending

Or an explained Trafficdump, first I started with Emerald 1.23.5.950 on my mac and did a TCP dump, why beaces that was the last version I had running n tat machine, and it whas with me at work. The Dump was made using Wireshark over a bluetooth connections to the internet during lunch break.

I will try to make a view of most of the traffic, as just a short SL session have about 4500 packets, This was a login an almost ressing one self over a slow line. I can't explain all packets.

34 52.149720 192.168.20.2 80.251.192.245 DNS Standard query A modularsystems.sl
35 52.160008 192.168.20.2 80.251.192.245 DNS Standard query AAAA modularsystems.sl
36 53.115613 80.251.192.245 192.168.20.2 DNS Standard query response A 213.133.100.231
37 53.162052 192.168.20.2 80.251.192.245 DNS Standard query AAAA modularsystems.sl
38 53.414537 80.251.192.245 192.168.20.2 DNS Standard query response

This tell the computer where modularsystems.sl are, it at the address 213.133.100.231. Next a connections to modularsystem.sl is made and the following data sent and recived:

HEAD /app/login/ HTTP/1.1
Host: modularsystems.sl
Accept-Encoding: deflate, gzip
Accept: application/llsd+xml

HTTP/1.1 200 OK
Content-Type: text/html
Accept-Ranges: bytes
ETag: "3318998541"
Last-Modified: Tue, 15 Dec 2009 13:00:01 GMT
Content-Length: 6964
Date: Tue, 15 Dec 2009 13:13:08 GMT
Server: lighttpd/1.4.19

After this one more http connections is made to the modularsystems server and a few more files downloaded:

GET /app/login/?lang=en-us&firstlogin=TRUE&channel=Emerald%20Viewer&version=1%2E23%2E5%20%28950%29&grid=Agni HTTP/1.1
GET /app/login/images/back.png HTTP/1.1
GET /app/login/images/excla.jpg HTTP/1.1
GET /app/login/images/Error.jpg HTTP/1.1

Feed2js.org is used to make the LL and the Modular system blogs into one list at the login page.

GET //feed2js.php?src=http%3A%2F%2Fwww.rssmix.com%2Fu%2F285120%2Frss.xml&num=6&targ=y&utf=y HTTP/1.1

Host: feed2js.org

The client downloads, /ga.js from www.google-analytics.com,even that javascript get's downloaded over a gziped connection. The java scripts will get a small file form google, that is used for the tracking in google analytics.


Once all the normal traffic to lindenlabs have been done, and you allow the viewer to update the clients tag data base the file "GET /app/client_tags/client_list.xml HTTP/1.1" will be downloaded form the server.

Emerald 1.23.5.1101 for linux

Update: http://greenlifeemeraldviewer.googlecode.com/files/Emerald-i686-1.23.5.1101.tar.bz2 Discrete got the official build out.

I have the Emerald 1101 build for Linux, it's build optimiced for Ubuntu 9.04 and newer, I have tested on 9.04 and 9.10. On 9.10 it works badly at least for me with pulseaudio, removing pulseaudio and it works well. (sudo apt-get remove pulseaudio;sudo apt-get install esound).

Installation is like:

wget http://www.acc.umu.se/~balp/second_life/Emerald-i686-1.23.5.1101.tar.bz2
tar jxf Emerald-i686-1.23.5.1101.tar.bz2

This will get it running, but voice is missing and the graphis uses the much slower OpenJPEG library. These have to be copied form the official viewer, or is you have the old emerals voice pack.

With the old Emerals voice pack:

cd Emerald-i686-1.23.5.1101/
tar jxf ../Emerald\ Non-Free\ Binaries.tar.bz2

With out that:

wget http://download.cloud.secondlife.com/SecondLife-i686-1.23.5.136262.tar.bz2
tar jxf SecondLife-i686-1.23.5.136262.tar.bz2
cd SecondLife-i686-1.23.5.136262/
cp bin/libllkdu.so bin/SLVoice lib/libfmod-3.75.so lib/libkdu.so lib/libvivoxsdk.so lib/libortp.so ../Emerald-i686-1.23.5.1101/
cd ..

Some checksums to verify:
sha256sum:
55ed30949cbc23d03e691821a7fa5c75a00c6dbb065bbce1f161cf968cc43938 Emerald-i686-1.23.5.1101.tar.bz2

GnuPG signature, it's signed with my new key:

pub   1024D/79B24AB7 2009-11-30 [expires: 2014-11-29]
      Key fingerprint = 92CF B806 5127 2ED0 7882  61F1 B5B4 7749 79B2 4AB7
uid                  Anders Arnholm (Balp)