I tried to data-mine today and bungie has implemented a lot of changes. Instead of Xur having one single constant IP on one port, he now has multiple. If you join a tower instance and you're the only one there, Xur will have 16 different IP address. If you join and its 8 other people, Xur will have 9 different ones. Only one of the possible IP's you connect to will share the packet information you need. The others will include self-input data like controller movement, date & time, and other player constants.
To combat this I used zone alarm on each IP separately until I isolated the one that sends the packets for weapons. This took considerably longer than I thought because each unique IP only sends packets for a 45 second window and then they stop for 100ms, and then restart. This made it hard to decipher the hex code and decide if there were any patterns.
Finally, once I managed to isolate the IP, find the pattern, and looped it. Every 22 packets started with the same 8b Hex. Bungie had literally broadcasted every thing as a No Land Beyond. This is what I found(obviously a troll), but yeah:
No Land Beyond 999 Attack Kinectic Damage
No Land Beyond 488 Defense Warlock Chest Piece
No Land Beyond 366 Defense Hunter Gauntlets
No Land Beyond 447 Defense Titan Helmet
TL;DR:
Bungie has employed 8 servers from their network, and 8 from Activision. They've employed a fail safe on 15/16. They constantly shuffle ports and IP's that lead to nothing. The one IP that does lead to anything has the name No Land Beyond for every weapon, armor, and upgrade.
