I've been doing some reverse engineering work since the beginning of the new year.
I noticed that the intra zone teleports do not work for most zones, so i manually added them for felwitheb and erudin. While testing out the zoning, i finally figured out how to set the initial camera position upon zoning, i.e. we can no specify that a player should look up or down after zoning - useful so that the player faces the right direction.
Upon till then, our zoning worked server side, that means when the player moved to a specific location the server noticed it and if the player hit a zone border of teleport pad, we moved him manually. This works fine but is alot of unneeded overhead.
Now back to the intra zone teleporting, it was weird that some teleports did work without any interaction, in erudin for example, the pad from the harbor up to the palace worked. That meant the client knew some coordinates already.
YL provided some interesting input, he noticed that when using eye of zoom near a zone line/pad - the eye would vanishe - the client would kill it. So the client somehow must already knew the locations from WHERE a player should be teleported too, what he didnt knew was the destination of the teleport.
Well after further reverse engineering, i found out that the client had some kind of teleport table with indexes. I found the opcode which needed to be sent to the client along with an array of teleport destination and each specific magic number of each teleport destination. The client already scans the area when a player enters a zone point, he has a hard coded ID for each of these - and we just have to tell him for each of these ID where to teleport the player.
So what that means is, in classic (and afaik still to date) - the client knows only the zone lines but the server will tell him where he should teleport too upon zoning in. After some research i found that eqemu developers could simply take a live packet dump and extract the zone points from there. This is of course 1000 times easier than manually adding each destination teleport point from your own memory (setting up only 8 intra zone points took me around 5h). Of course the destinations change of time so we cant simply take a live dump now, but some older data might be useful, i think i got that covered.
BTW: One interesting info i found during reverse engineering was a funny opcode - it enables us to play a specific sound file to the player. The are all indexed by ID - so any wave file the client knows, we can play it. And the funny part is - if you use an unknown ID you get "This is an error message, please report the bug" in a muffled developer voice =p