# SSTAP_ip_crawl_tool: proxy rules generated by watching a game connect

> SSTAP_ip_crawl_tool is a Python script that observes a running game process and turns the remote addresses it contacts into SSTAP or Netch proxy rule files. It is a Windows tool with a GUI build, a GPL-3.0 licence, and a documented need for administrator rights once UDP capture is involved.

**oooldtoy/SSTAP_ip_crawl_tool** — 一个自动获取游戏远程ip，并自动写成SSTAP/NETCH规则文件的脚本

- Repository: https://github.com/oooldtoy/SSTAP_ip_crawl_tool
- Stars: 668 · Forks: 85
- Language: Python
- License: GPL-3.0
- Published: 2026-10-21 · Updated: 2026-10-21 · Language: en
- Canonical page: https://hysenlabs.com/projects/oooldtoy-sstap-ip-crawl-tool

## Rules written from a session instead of downloaded from a list

The project description is a single sentence in Chinese that translates to a script which automatically obtains a game's remote IP addresses and automatically writes them into SSTAP or NETCH rule files.

Those two client names define the whole scope. SSTAP and Netch are proxy clients for games, and both consume a rule file that says which addresses to route through the proxy and which to leave alone. The traditional way to get such a file is to download a maintained collection, and the README links the two upstream projects for that, SSTap-Rule and Netch. This tool is the opposite approach: instead of trusting somebody else's list, you watch your own game and derive the addresses from what it actually does.

That is a sensible answer to a specific problem. A game's servers change, a new region ships, a launcher talks to different endpoints than the game client, and a shared list lags behind. Running the tool during one session produces a list matched to that install, that region and that day.

The audience is therefore a Windows player rather than a network engineer. The repository layout says as much: ip_crawl_tool.py is the command line client, gui.py is the interface version, config.py holds the configuration, and mods.py, tcp.py and udp.py separate the capture logic by protocol and helper functions.

The language is Python. The README states the script was tested on version 3.9, that other versions are unverified, and that in theory anything above 3.0 should work. The licence is GPL-3.0, which matters if you plan to modify it and ship a closed-source tool, since that obligation is different from the permissive licences most Windows utilities carry.

## UDP capture means firewall logs and administrator rights

The README carries a bold warning, and it is the single most important operational fact in the document.

It says that from version 3.3.3 onwards, UDP protocol capture was added, and that this requires opening the Windows firewall and running the program with administrator privileges, mainly so that the firewall log can be opened and read. That is a real design decision rather than a workaround: reading TCP connections is easy because the operating system exposes them per process, while UDP is connectionless, so the addresses a program sends to are recovered from firewall log entries instead.

The changelog shows how the tool matured, and it is a useful map of the design. Version 3.2 fixed IPv6 filtering and changed the file naming logic. Version 3.3.3 added UDP protocol capture, 3.3.5 added a display of UDP child processes, 3.3.6 fixed IP sharing, and 3.4 fixed a bug where internal-network addresses and dropped packets were captured. Version 3.0 added automatic rule upload and a quick rule preview web service, 3.0.1 fixed rule upload failing under the SSTAP proxy and hid the last two digits of an address on the web page, and 3.1 added a web admin page and moved all configuration into config.py.

Then the direction changed. Version 4.0 deleted the upload-to-server feature, added a Netch mode and a folder selection mode, and 4.1 added the user interface you can see in the repository screenshot.

Removing the upload feature is the interesting reversal. An earlier design shipped your captured addresses to a server; the current version does not, and there is no web admin page in the tool any more. For a user, that means the data stays on your machine.

## Start it, name the process, play, and close the window

The usage instructions are short and describe a live interception rather than a scan.

You launch the program, either ip_crawl_tool.py or the packaged executable, and the GUI version is gui.py. Then you enter the name of the program whose addresses you want to capture, and following the prompts you also enter the game's English name and Chinese name. At that point the tool enters its capture state.

With the capture running, you start the game with the global proxy enabled, and the tool automatically captures the addresses and writes them into the rule file. When you have the addresses you need, closing the window exits the program.

Two details in the README affect whether the result is any good. The first is duration: the text says that to ensure the completeness of the captured rules you must run it for several minutes, meaning leave the global proxy and the tool on and play for a while. A game that connects to one endpoint during the first ten seconds will produce a one-line rule file if you close the tool straight away.

The second is where the output lands. The rule file is written into the program's current directory, which means the working directory you launched the tool from, not a configured location. The 4.0 release added a folder selection mode, which suggests the original behaviour was inconvenient enough to fix.

The overall shape is worth internalising: this is an observation tool, not a scanner. It has no knowledge of which addresses a game might use, and it cannot enumerate servers that your session never touches.

## Finding the process name is the first thing the user has to do

The README spends a section on how to get the program name, because that string is the key to everything the tool does.

The instructions are a screenshot walkthrough. Open the game first, then open the task manager and find the game process. Right-click that process and open its properties. The program name is the value shown in the highlighted position, and the screenshots walk through each step.

This is a Windows workflow by definition, and it is the reason the tool is Windows-only in practice even though the code is plain Python. Getting the exact executable name right also matters for correctness rather than just for typing convenience, since the name is what the capture logic matches against the running processes.

One related Windows detail appears as a footnote in the usage section. If the command line cannot display Chinese characters, the README tells you to change the default cmd encoding to 936. That is the code page for Simplified Chinese, and it is the kind of detail that dates a tool to a specific era of Windows console behaviour.

Taken together, the steps are short but they are all Windows-specific: task manager, process properties, firewall log and cmd code page. Porting this to another platform would mean replacing all four.

## Prebuilt executables for people without Python

The README anticipates that many of the people who want this tool do not have a Python installation, and points them at the packaged builds in the release section. Two links are given, one for the command line build and one for the UI build, both versioned v4.1.2 under the v4.1 release path:

```bash
https://github.com/oooldtoy/SSTAP_ip_crawl_tool/releases/download/v4.1/ip_crawl_tool.v4.1.2.exe
```

```bash
https://github.com/oooldtoy/SSTAP_ip_crawl_tool/releases/download/v4.1/ip_crawl_tool_gui.v4.1.2.exe
```

Running a prebuilt executable from a download link is a decision with a trust cost, and the project is candid about the alternative: the source is in the repository, the licence is GPL-3.0, and the Python route with psutil as the only third-party dependency for the client is straightforward if you prefer to read the code first.

The release history also tells you where the project is. Tags include v4.0 from 2021-01-01, v4.1 from 2022-09-02 and V4.1.2 from 2025-11-08. So the executable links in the README point at a build from November 2025, while the last push to the repository was on 2026-09-29. Commits are landing after the packaged binary was built, which means the current source and the downloadable executable are not the same thing.

## Where the approach stops working

The limits of this tool follow directly from its design, and the README is honest about most of them.

It only knows what your session touched. A rule file produced from one afternoon of play covers the lobby, the matchmaking service and whatever region you happened to be assigned. Games that route through a launcher, that change servers by time of day, or that open connections only when a particular mode is played will produce different files on different days. The README's own instruction to run it for several minutes is an admission of this.

It is bound to Windows in practice, through the task manager workflow, the firewall log for UDP, and the cmd encoding requirement. It needs administrator rights for the UDP path, which on a managed corporate machine is often not available at all.

The alternative approaches are two, and they differ in where the addresses come from. The first is the one the README links: the upstream SSTap-Rule and Netch rule collections, where somebody else maintains the list for every game. You get broader coverage of a game but you inherit their update lag and you cannot correct a missing entry yourself. The second is writing the rule file by hand, which gives complete control and costs an afternoon per game.

This tool sits between those two. It is more accurate than a shared list for the specific thing you just played and less complete than a maintained collection. That is exactly the trade you want when a shared list is missing your region and wrong for your install, and it is the wrong trade when you play many games across many regions.

## Conclusion

SSTAP_ip_crawl_tool fits a Windows player whose game connects to addresses that a shared rule collection does not cover, and who is willing to run the tool as administrator with the Windows firewall in front of it. It is the wrong choice for a non-Windows machine, for a user unwilling to grant administrator rights and read firewall logs, and for anyone who expects a maintained rule database rather than a snapshot of one play session. Before running it, check the release binary you download against the latest tag, note that UDP capture needs administrator rights and the firewall log, and remember that the README states rules are only complete if you leave the tool running and playing for several minutes.

## FAQ

### How do I use SSTAP_ip_crawl_tool to generate proxy rules?

Launch ip_crawl_tool.py or the packaged executable, enter the name of the program to capture, then enter the game's English and Chinese name. With the global proxy enabled and the game running, the tool captures the addresses and writes the rule file into the program's current directory, and closing the window exits it.

### Does SSTAP_ip_crawl_tool need administrator rights?

Yes for UDP capture. The README states that since version 3.3.3 the UDP protocol capture requires opening the Windows firewall and running the program with administrator privileges, mainly so the firewall log can be opened and read.

### Can I run SSTAP_ip_crawl_tool without Python installed?

Yes. The README links prebuilt executables in the release section, a command line build and a UI build, both versioned v4.1.2. The script itself was tested on Python 3.9 and uses psutil as its third-party dependency.

### How complete are the rules the tool writes?

The README says that to ensure completeness you must run the tool for several minutes with the global proxy on and the game playing, since the tool only captures the addresses your session actually contacts. It also notes that rules land in the program's current directory.

## Sources

- [Issues](https://github.com/oooldtoy/SSTAP_ip_crawl_tool/issues)
- [License: GPL-3.0](https://github.com/oooldtoy/SSTAP_ip_crawl_tool/blob/master/LICENSE)
- [oooldtoy/SSTAP_ip_crawl_tool on GitHub](https://github.com/oooldtoy/SSTAP_ip_crawl_tool)
- [README](https://github.com/oooldtoy/SSTAP_ip_crawl_tool/blob/master/README.md)
- [Releases](https://github.com/oooldtoy/SSTAP_ip_crawl_tool/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/oooldtoy-sstap-ip-crawl-tool