You are reading:
Under the Surface of Azeroth:
A Network Baseline and Security Analysis
of Blizzard's World of Warcraft

Step 6: Loading the Character Select Screen
Once the list of available realms is downloaded to the client, the next step displays the list of characters to the end user. If a World of Warcraft player is new to Azeroth, the list of available realms is shown. If a character already exists within an account, the last-played character will be shown with other options for selecting additional characters or realms.

Frames 22 through 42 document this process. Since the client has already downloaded a list of every available realm, the client connects to the last-known realm using its IP address and TCP port number. That's why a DNS query doesn't exist for this new IP address of, since the World of Warcraft client already knows where it needs to go.

The account name is transferred in frame 26, along with other information that isn't plainly readable from the ASCII decode. Additional nondescript data is transferred in the following frames, and in frame 41 a list of the characters available on the current realm is transferred from the current realm server to the World of Warcraft client.

This is a graphical view of the entire 42-frame login process from the authentication through the character select screen. The three spikes near the beginning of the graph denote the download of the 222 realm names and IP addresses.

The network communication was very minor during this time period. Even with the short burst of realm information, bandwidths never exceeded 50 kilobits per second.