Minecraft anticheat guide
BadPackets and Timer Checks for Packet Abuse
How repeated slot packets, critical spoofing, swing timer behavior, and packet cadence checks help detect invalid clients.
Protocol examples reviewers can grasp
Packet-abuse checks look for client behavior the protocol should never produce: repeated held-slot packets with no gameplay purpose, interaction sequences that contradict open state, critical-hit flags without the required fall or motion context, and swing cadences that ignore the server's timing reality.
These are concrete protocol contradictions, and they read well in staff training because each maps to an expected packet order that legitimate clients follow.
Where movement claims stop
BadPackets and Timer findings must not be stretched into movement verdicts. A repeated-slot anomaly says nothing about speed or flight, and a swing-cadence anomaly says nothing about reach. Each check family owns only its own evidence.
FairPlay checks can review repeated slot packets, critical spoofing, macro damage, and swing timing. Review each alert with the relevant check details before taking action.
Triage for protocol flags
Keep protocol checks alert-first during onboarding, since plugin-modified clients and unusual setups can produce odd-but-benign sequences. Escalate on repetition and corroboration across sessions rather than on single spikes.
For appeals, preserve the contradicting sequence itself: which packets arrived in which order and which expectation they broke. That record is reviewable without exposing anything sensitive.
FAQ
Can a BadPackets flag prove movement cheats?
No. Protocol checks own only their own evidence. Movement conclusions need movement-family corroboration.
What makes a protocol flag escalation-ready?
Repetition across sessions, corroborating flags, and a preserved contradicting sequence with timing context.