Salvage Bans v 2.0

[Draylo]

Yeah, probably monitoring the hotspots (Salvage) for people pulling that shit.

Believe what you want to believe buddy because I dont believe this game, with its archaic network code, can detect 12% without a slew of false positives, considering this same network code was generating false positives on people going 60% way back when. And I highly doubt SE fine tuned the network code, considering there are a bunch of more glaring gameplay issues they've said "deal with it" to.


Didnt SE tell us back in 05 or whatever that they added an auto-detection feature? Or was it forced out when people were complaining about false bans on forums?

Or they can simply see what item the user has for any type of movement speed+ and notice they aren't using any? I don't know of many that use speed boosts that actually equip the items.

[NynJa]

Thats still active monitoring, not auto-detection.

[arus2001]

I actually wouldn't be surprised if they slipped the detection code in with that monsters use to determine aggro/linking. These things have to be cycling constantly and if you understand how to map distance between two sets of Cartesian coordinates, you can then run that against base movement speed and present gear/buffs or lack thereof. Put another way, even if players don't see you, every monster does.

[Lolwutt]

They've always been able to retroactively confirm speedhacking. That means, at the very least, your position updates are being logged. Even if they don't have an active detection system, they have at least a tool where someone can put in a char name/server(or entity id) and get a report on whether they had any bad movement without manually reviewing any logs. This is common sense, GMs don't have the training to review any sort of logs by hand and determine on their own whether cheating occured. It'd be easy to confirm speedhacking even at a low rate when examining position logs over any period of use that lasted more than a couple seconds, and easy to confirm poshacking from a single instance.

Such a tool could be automatically ran on random accounts at times of low load. It could be ran manually on random accounts. It could be ran methodically, one server at a time at a GM's discretion. These are single for loops to implement in all likelihood, no matter how incompetent you want to insist they are it's not above their head.

The bottom line is that they hold all the cards. Nobody without inside information can conclusively prove how their systems work, because it's extremely difficult to take all reports at their word and SE isn't very transparent. It's still incredibly foolish to use speed or position manipulation in the current meta, and the thought that it's ok if nobody sees you is flawed for quite a few reasons.

@Arus: No, they aren't using aggro detection or anything related to monsters. It'd be much too costly. If anything, a realtime check would be implemented in movement updates. It's only 5 floating point operations 3x a second (XDif^2) + (YDif^2) + (Zdif^2) <= (timePassed * runspeed)^2. It wouldn't be any significant footprint doing it that way, even across thousands of users. They used a system somewhat like this in 2008, and it caught people falsely because lag would result in 2 adjacent position updates being a significant distance apart if they had router/modem trouble. However, we know they have the code for such a system, and the servers can handle it from their prior use. If they adjusted it to require a significant amount of consecutive hits or check the synchronization bytes from the packet they could turn the old system into a reliable detection system that isn't going to react to lag pretty easily. It could even be flagged post-report to catch someone on their next use.

[Mugekuge]

don't need any network code really, outgoing packet is sent in fixed intervals and you can measure the difference between 2 consecutive ones.. some filtering of matching sequence ids and gaps in communication and it wouldn't be hard to safely detect as little as 3-4% when a player is running in a straight line or on autorun

doesn't mean they did it, but you're a fool if you think it's anything particularly difficult to implement

Sorry but this doesn´t work like you are saying, too many variables will affect the result.

I don´t think there is any auto detection tool, just people getting flagged for not being careful. That´s it.

[ColenzoRidesAgain]

The way they catch you for speedhacking has to do with how fast you're moving on foot from one zone to another. If you try to speedhack from say,
port jeuno > sauramauge > meriphitaud

If you go from port jeuno zone line to meriphitaud zone line in say, something under a minute or something on foot and try to zone then you get some sort of error that tells you to wait longer. This pretty much insures that you're going to get the ban hammer. They have banned SO many people this way. Basically if you don't want to get banned dont be going balls out on the flee tool. Otherwise they will have to really monitor your account with somebody there watching you speed hack.

Unless they updated the methods in which they catch people with this, this is the only way they can catch you.

[Draylo]

So much misinformation. Can we all at least agree that they are heavy handed with suspension/bans recently so they are either vigilant in watching everyone or they implemented something new that all you armchair GM's don't know about. I'll have to agree with Thornyy post and say it is foolish to use any of that as of now.

[Diavolo]

So much misinformation. Can we all at least agree that they are heavy handed with suspension/bans recently so they are either vigilant in watching everyone or they implemented something new that all you armchair GM's don't know about. I'll have to agree with Thornyy post and say it is foolish to use any of that as of now.

The population's dwindled a good bit over the last few years, I'm sure it just seems like SE's being more heavy handed with the bans now because those getting hit are both more vocal and far less discreet about what they're doing. I've seen my fair share of people get banned in the last few months and there isn't a single one of them that was using their third party tools with any sort of discretion, this thread being a prime example of that. Get away with something long enough and you're likely to let your guard down.

[LiquidFriend]

Considering until recently, they really did nothing to obvious botters, any activity at all would be considered heavy compared to the old norm.

Wouldn't surprise me if they just aren't looking at logs from battlefields/people hitting zone end too fast and doing bans from that and maybe a couple GM calls at tops. Think people are really underestimating how lazy FFXI players are and can't be bothered to take any time from poopsocking to fill out a report to the STF.

[steellord]

Doing auto-detect would be impossible without utilizing a sh!t ton of CPU cycles which would cause massive lag.

That isn't true. They had an auto jailer years ago, and would just have to fine tune it to not catch false positives, or check logs once a character is flagged to make sure it wasn't lag. Would explain why it took 2 weeks to ban me after i had quit. They've also very publicly used this process in the past, for salvage 1 bans. This would just be combining the tools they have.

The one thing i can't believe is the high accuracy and large # of bans isn't automated in some way. Especially since they probably have 2-3 GMs left on salary, and a lot of bans come from solo salvage etc, there's no way they rely on reports only.

[steellord]

Considering until recently, they really did nothing to obvious botters, any activity at all would be considered heavy compared to the old norm.

Wouldn't surprise me if they just aren't looking at logs from battlefields/people hitting zone end too fast and doing bans from that and maybe a couple GM calls at tops. Think people are really underestimating how lazy FFXI players are and can't be bothered to take any time from poopsocking to fill out a report to the STF.

I don't recall any period before where moving at 12% flee, with auto disable, would lead to a ban, like it has recently even to new chars. I saw ppl flee 200% to a claimed KB back in 2007, or jump the ledge to fafnir, not to mention the myriad claim bots or even "melee assist" for exp. The one thing they did ban for was pos

Situation has gone from, on my server, people flying around in jeuno shouting "LOOK AT ME I CAN FLY", to like i described, in the past few weeks barely fleeing, and they perma ban first offense.

Since the bans started, even some trying to be discreet got hammered. After my LS leader got hit and we had to reform, we were all well aware of the risks. No longer were people sliding around dead for raise or flee pulling at events. Still, half my LS is banned since then. The only time i remember an LS getting banned en mass was for exploits like duping. So in some cases it seems heavy handed both from recent non enforcement and the game's history, and the detection has a far lower threshold

I think it'll go on indefinitely, and is an auto detect installed for post november. I'm sure they'll be phasing out GMs/STF too

As to those claiming they run around 300% still, not sure i believe it, or their days are numbered as the log confirmation is done.

[steellord]

I do not think it is auto-detect. I never stopped using cupper/tako. Run at 300%, used the warp function on tako for a few assaults(even wound up on the wrong map lol), used reposition until that broke, and used maintenance to get through doors. I have not been tagged, yet. What I don't do is run as soon as I get into a zone where people might be because detection can lag. I don't speed through a zone faster than it should take(except salvage 10-15 minutes on bst) because there does seem to be auto-detect on the zone lines again. I don't bot exp anymore while not at my computer(I do miss those 20 hr+ sessions while sleeping/working), nor do I speed hack while exping.

Yeah well i did the same and figured the news of bans on here and AH were just attention whoring scare tactics. But within a few weeks...

[steellord]

Yeah, probably monitoring the hotspots (Salvage) for people pulling that shit.

Believe what you want to believe buddy because I dont believe this game, with its archaic network code, can detect 12% without a slew of false positives, considering this same network code was generating false positives on people going 60% way back when. And I highly doubt SE fine tuned the network code, considering there are a bunch of more glaring gameplay issues they've said "deal with it" to.


Didnt SE tell us back in 05 or whatever that they added an auto-detection feature? Or was it forced out when people were complaining about false bans on forums?

They ain't gonna in real-time monitor salvage any more than they monitored the duping. If they were, people would get sent to moridon at the time it happens and chewed out by a GM. What's been going on with ppl stopping all 3PP or unsubbing, only to get ban weeks later, they're clearly checking server logs

And yeah auto jailer had false positives, which is why you keep the auto detect but not auto jailer, and check logs to verify. I don't know why you think this is impossible, trying to convince yourself it's safe still? With the cutbacks they're making by november, this is the most likely explanation. They won't have an STF, gotta implement somethin else

[Lolwutt]

Sorry but this doesn´t work like you are saying, too many variables will affect the result.

I don´t think there is any auto detection tool, just people getting flagged for not being careful. That´s it.

Care to mention said variables? Lag is irrelevant, as every movement packet contains a timestamp of when it was sent, down to the millisecond. If the timestamp is used, they know how much you moved in how long using your own client's time report instead of anything lag could influence. They're sent every 350ms roughly and position is sent as a float with 6 digits of decimal precision. As little as 3% movement could be detected without false positive by simply calculating distance over time using timestamp.

[Saevel]

That isn't true. They had an auto jailer years ago, and would just have to fine tune it to not catch false positives, or check logs once a character is flagged to make sure it wasn't lag. Would explain why it took 2 weeks to ban me after i had quit. They've also very publicly used this process in the past, for salvage 1 bans. This would just be combining the tools they have.

The one thing i can't believe is the high accuracy and large # of bans isn't automated in some way. Especially since they probably have 2-3 GMs left on salary, and a lot of bans come from solo salvage etc, there's no way they rely on reports only.

I think your confusing real time checking with a separate post analysis. Real time checking would indeed utilize a sh!t ton of cycles because you can't just compare a few packets, too high a chance for false positives, you need to chart out a history and then compare it to a valid movement model. This isn't much of a thing with a dozen connections or so, but once you scale past a hundred you really need to start considering the additional CPU requirements to constantly check every single connection's movement value. A more reasonable approach would be a second system that routinely goes through the logs and charts out movement patterns then determines a yes or no. This secondary system wouldn't be doing it in real time, it would be a on-demand approach and would take overnight to crunch all the numbers, since it's offline it doesn't matter how long it takes and it won't effect the server operations themselves.

Anyhow, I know they aren't doing this on every account because I've known entirely too many people who are still moving 50%+ over neutral. What's most likely happening is they only do such a scan whenever they receive a report on someone, or some other method flags an account for possible activity. It's much easier to avoid false positives if you have some form of filtering on who your checking.

[LiquidFriend]

They are likely going through instanced popular event logs and zone line speed traps. People are likely getting nailed for stuff that happened long ago and are spooking others into thinking that S-E actually took the time to write an advanced auto-trigger (lol), or that people really get their panties all bunched up enough to fill out an report to the STF because they ran a little faster.

This is S-E we're talking about here, and a S-E with limited people. They are just slowly getting to the shit.

[Draylo]

You have no idea what you are talking about

[LiquidFriend]

Gotta be dumb as hell to really think they designed an advanced auto-detect tool by this point in the games life.

[Lolwutt]

gotta have no idea what you're talking about to think that it's anything more than the decision to do it at stake

i could write a reliable speedhack detection into their system in an hour or less by myself

[LiquidFriend]

Not debating that isn't possible. I'm just saying they don't give enough of a fuck to do it and it's debatable if it'd be done right if they did.

This is the same developer that couldn't be assed with trying to figure out why the glacier was the most popular zone for years, why many people were fishing on accounts around the clock and what the fuck was generating all this new gil. They only care when necessary.