Retail Packet Captures Format Guide

When processing unzipped retail packet captures, you will typically encounter a standard directory structure. These captures are usually provided as a .zip file, which unpacks into a parent folder representing the content's title, followed by a character folder containing the extracted capture data.

Folder Structure

A typical unpack hierarchy looks like this:

[Title Folder] / [Character Name] / [Addon Folders]

Important Addon Folders and Their Uses

Inside the character folder, you will find data generated by various capture addons. Folder names may vary slightly in capitalization or structure depending on the logger version. Here are the most important folders and how they should be utilized:

1. eventview / EventView

Contains data regarding cutscenes and events.

  • eventview/simple (or .log files directly under the character name directory): This is the primary directory you will use. It contains logs (usually one .log file per zone) outlining simplified event data. Use these files to fill out mission and quest event information when migrating or writing scripts for the Interaction Framework (IF).
  • eventview/raw: Contains more verbose, raw event data if deeper debugging is needed.

2. npclogger / NPCLogger

Contains data regarding NPC locations, behaviors, and properties.

  • database folder or .db files: Depending on the capture, this may be a database folder with .lua files per zone, or .db SQLite files directly in the NPCLogger folder. You will use this data to populate or update NPC details, positions, and parameters in sql/npc_list.sql.
  • Other folders (like logs, tables, widescan) contain additional raw or parsed NPC data which can be used as supplementary references.

3. caplog / CapLog

Contains chat logs from the game client during the capture session.

  • *.txt or *.log files: These files represent the capturer's chat window. They are extremely useful for reading notes left by the capturer or seeing the text spoken by NPCs as they are interacted with. This can provide crucial context to help you understand which event is currently playing out.

4. packetviewer / PacketLogger

Contains raw network packet information.

  • Contains incoming and outgoing folders with packets separated by their hex IDs (e.g., 0x034.log or 0x0D3.log), as well as consolidated full.log, incoming.log, and outgoing.log files. This is used when deep-diving into specific raw packet data to understand complex or unmapped game client behaviors.

5. Additional Addon Folders

You may also encounter other specialized folders:

  • ActionView: Logs actions and events (sometimes contains its own simple folder with logs, similar to EventView).
  • PathLog: Contains .csv files tracking PC and NPC movement paths. Useful for recreating NPC patrols.
  • ShopStock / GuildStock: Contains .db files (BuyList.db, SellList.db) logging shop and guild inventory data.
  • KITrack: Tracks Key Item acquisitions.
  • HPTrack: Tracks Home Point unlocks/interactions.
  • AttackDelay: Logs related to attack speeds and delays.

General Workflow

  1. Use caplog to read the flow of the capture and gather context from player notes or NPC dialogues.
  2. Use eventview (specifically the simple logs) to map out the steps, parameters, and event IDs for your Interaction Framework (IF) implementation.
  3. If new NPCs are encountered or existing ones are missing data, use npclogger to prepare their npc_list.sql entries.
  4. Fall back to packetviewer / PacketLogger or eventview/raw only when you need to understand low-level network interactions that aren't obvious from the simplified logs.