Skip to content

Add configurable ping-flood speedhack detection (PingFloodMax)#1589

Open
canerksk wants to merge 1 commit into
Sphereserver:devfrom
canerksk:ping-limiter
Open

Add configurable ping-flood speedhack detection (PingFloodMax)#1589
canerksk wants to merge 1 commit into
Sphereserver:devfrom
canerksk:ping-limiter

Conversation

@canerksk
Copy link
Copy Markdown
Member

@canerksk canerksk commented May 30, 2026

Adds a 30-second sliding window detector on packet 0x73 (ping) to catch clients running at abnormal speeds. ClassicUO sends one ping per second (~30/window); exceeding PingFloodMax triggers a warning log and kicks the client.

New sphere.ini option: PingFloodMax=50 (0 = disabled).

Adds a 30-second sliding window detector on packet 0x73 (ping) to catch
clients running at abnormal speeds. ClassicUO sends one ping per second
(~30/window); exceeding PingFloodMax triggers a warning log and kicks
the client.

Fixes a unit mismatch from the original port: the old sphere used tick-
based time (GetTimeRaw = ticks), while Source-X returns milliseconds,
so the 30s window was actually 300 ms. Now uses MSECS_PER_SEC correctly.

New sphere.ini option: PingFloodMax=50 (0 = disabled).
@Jhobean
Copy link
Copy Markdown
Contributor

Jhobean commented May 31, 2026

Interresting feature! It should prevent crappy player of flooding the server.

Why you talk about speedhack detection on the comment? Using speedhack send extra ping request?

@canerksk
Copy link
Copy Markdown
Member Author

canerksk commented May 31, 2026

Interresting feature! It should prevent crappy player of flooding the server.

Why you talk about speedhack detection on the comment? Using speedhack send extra ping request?

Yes, ClassicUO's game loop is built on XNA/FNA.

Time.Ticks = (uint)gameTime.TotalGameTime.TotalMilliseconds;
In FNA, gameTime uses QueryPerformanceCounter. When Cheat Engine hooks this, the chain breaks like this:

Cheat Engine: 2x speed
QPC returns a fake value
FNA gameTime progresses 2x faster
Time.Ticks increases 2x faster
The 400ms delay in WalkerManager actually passes in 200ms
2x more movement packets are sent per second
Server packet flood → queue fills → ping flood

Please also try Default ClassicUO and Sphere-X;

https://www.cheatengine.org/downloads.php
image

@Jhobean
Copy link
Copy Markdown
Contributor

Jhobean commented May 31, 2026

Good to know thx!

What I noticed when implemented speedhack detection on sphere was the difficulty to detect speedhack 1.1 or 1.2. the problem is we aleays get false positive when a player have a shitty ping/ingernet connection.

By the way I like this new feature because it can permit admin to be more agile.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants