NoCheatPlus

Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
-
View User Profile
-
Send Message
Posted Mar 5, 2013@LordKainzo
Just like "/testncp velocity 3" for instance. It will add velocity for the looking direction.
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
Yes but I'm unsure how to use it... here's a screenie.

-
View User Profile
-
Send Message
Posted Mar 5, 2013@LordKainzo
Thanks, that is what i am looking for.
Does "/testncp velocity ..." work ?
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
Here's probably the most logs I can show you.
http://pastie.org/private/esprehqaizz2nubuiuevq
It definitely happened - and the checks were running.
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
I am testing with the latest bukkit-dev you posted 16 hrs ago.
I'm going to update TestNCP and put in the debugs you requested. :) hold!
-
View User Profile
-
Send Message
Posted Mar 5, 2013@LordKainzo
Setting one of the debug flags would do it:
The interesting part is from jumpphase=0 with ground -> ground or ground -> air, all the way to the violation.
TestNCP:
http://dev.bukkit.org/server-mods/ncptools/files/4-test-ncp-1-3-0/
Also interesting for comparison would be if you get violations for "/testncp velocity ..." putting in the amount, it would add velocit into the viewing direction.
Edit: What server version are you testing with ?
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
The only way I fixed tihs issue was by removing the survivalFLY check altogether, once that was disabled, I was no longer being pulled back to the same spot I used skill-jump at.
Note that I believe it has to do with the velocity / how fast I'm being sent forward, not the up and down = flight/hover.
http://pastie.org/private/ll8wqvuc0hmllduoqzeuzw
You are welcome to join me on my test server (test.hc.to)
I'd love to find a way around this - it is working fine on the previous RB of NCP.
Also note: how do I enabled that move debugging and I think I may have an older testNCP on my test (where can I find latest?)
-
View User Profile
-
Send Message
Posted Mar 5, 2013@LordKainzo
With graceticks 100, something is wrong :), it means that velocity can't get invalidated within 100 ticks usually, i.e. 5 seconds. The test setup is a local server or a remote server?
Is it the latest TestNCP version (showing lag too)?
Concerning the moving debug trace: can you paste the move-spam from jumphase 0 until violation? (it should be something like hannebal XYZWorld ....(coordinates)... and other.
Setting moving.debug or checks.debug to true should result in such a trace.
To add: the debug trace is best done with no other / few people on the same server.
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
Making sure that this is coherent - I have attempted to adjust the graceitcks and other settings that I'll copy below, here's the info on it again
config.yml
survivalfly:
active: true
extended:
vertical-accounting: false
falldamage: true
actions: log:flyshort:3:5:f cancel vl>100 log:flyshort:1:5:if cancel vl>400 log:flylong:0:5:cif cancel
hover:
active: false
step: 5
ticks: 80
loginticks: 0
falldamage: true
sfviolation: 500
accounting: false
sneakingspeed: 260
velocity:
graceticks: 100
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
Okay, I enabled debugging and TESTNCP for a player "hannebal"
Here's what came up.
If you need it without the picture let me know I can type it out. It seems that when the jump goes too far, the check pushes the player back.
I am doing very basic code to get Skill-Jump to function and other velocity changing skills be affected by this. I have attempted to completely disable this new check and that didnt work.
17:45:36 [INFO] [TestNCP] Hannebal MOVING_SURVIVALFLY vl 14.631 (+14.631) Details: TAGS=permchecks+hspeed+hbufuse DISTANCE=0.69 LOCATION_FROM=-0.03, 162.32, -47.64 LOCATION_TO=-0.06, 162.75, -48.17 cancel=true
17:45:43 [INFO] [NoCheatPlus] Consistency-checks run.
-
View User Profile
-
Send Message
Posted Mar 5, 2013@asofold
Testing now on latest.
-
View User Profile
-
Send Message
Posted Mar 5, 2013A new release is available:
NoCheatPlus 3.8.10-RC-b438
A couple of new checks, a good range of fixes. Some checks have been "revived", since they had been removed previously or even been mostly inoperable (e.g. direction checks).
-
View User Profile
-
Send Message
Posted Mar 5, 2013@Sotlol1
I recommend not to use it.
Edit: It may work without plugins or with "simple" plugins, but there can be various unwanted effects, some of which are not simple or even hardly possible to track back. It might work with NCP, but since NCP is "complex" i would rather restart (the configuration reloading should work without problems). For a test server it may be ok, but as soon as issues arise, be sure to test it again with a clean restart and without any reloading.
-
View User Profile
-
Send Message
Posted Mar 5, 2013That /reload thing i dont understand does it work now or not?
-
View User Profile
-
Send Message
Posted Mar 5, 2013@4lfalfa
I overlooked the note about no plugins .
This is not a known issue, neither can i reproduce it at present.
Where / how do you respawn? Inm the worlds spawn (vanilla), or in a bed, on what block types?
If you can systematically reproduce it, you might go to our jenkins and download the build 439 (the one after the recommended one) If you test alone, you can then set checks.debug to true:
This will output a lot to the console. If you can reproduce it with that setting it would be very helpful to see the moving log.
Seems 439 has other issues with Survivalfly, but it shoudl be ok for testing the login issue. Alternatively you coudl use the recommended build and adit the BuildParameters.properties file inside of the jar, setting DEBUG_LEVEL=1 instead of 0. But first i would be interested in the circumstances (respawn location, blocks underneath/nearby).
-
View User Profile
-
Send Message
Posted Mar 5, 2013@4lfalfa
Maybe has been fixed in the upcoming release (waiting for approval).
But basically a distance of 0 does not mean no violation, which may be not optimal. Naturally if you are flying without moving and would move the head, you will trigger this violation, because a normal client would fall if not on ground.
Technically this must be a case in which you are standing on some block which is not recognized as ground, thus any head turning will be interpreted as a move in air, consequently at some point it will trigger a violation.
The reason is totally uncertain, it could be a conflict with other plugins (Authentication plugins, NPC plugins like citizens if using the players names, plugins that can change blocks properties like SpoutPlugin if using custom blocks).
-
View User Profile
-
Send Message
Posted Mar 5, 2013i has bugz, useing craftbukkit-1.4.7-R1.0.jar without any other plugin activated
nocheatplus version: A: NoCheatPlus 3.8.9-b353 for CB 1.4.7-R0.1 Jan 30, 2013 ( the newest )
when i die and click on respawn, it kicks me for survivalFly
to be more precise, it kicks me when i move the mouse after i respawnd
i have default configuration
it also logs stuff like this:
13.03.05 18:53:24 [INFO] 4lfalfa failed SurvivalFly: tried to move from -207.50, 71.00, 132.50 to -207.50, 71.00, 132.50 over a distance of 0.00 block(s). VL 566.
.. always with 0.00 block(s)
should be fairly easy to recreate, any way to fix?
-
View User Profile
-
Send Message
Posted Mar 5, 2013@jaimecamara
It is not lightweight. Main factor is the players moving, which needs a lot of attention to both cover exploits and not cause too many false positives at the same time.
How do you think it causes actual lag? Despite being heavy NCP is designed to run pretty smooth concerning performance. What you will see though is that if the server suffers a bigger lag spike anyway that NCP has to process all the delayed events coming in within the next server tick.
-
View User Profile
-
Send Message
Posted Mar 5, 2013Why the nocheatplus weighs so much? And gives so much lag on the server?
-
View User Profile
-
Send Message
Posted Mar 4, 2013@NuggetFace
I suspect an offline mode plugin, since a null Location or null world on player join is something CraftBukkit would not do on its own, as far as i can judge it. Online would be better i guess.
@LordKainzo
Changes everywhere. Concerning velocity we need a moving trace. If you can reproduce your problem locally or on a test server, i would appreciate a log from the move with the setting
Use the latest recommended build for it, if it is done correctly, your console should be spammed with moving info and possibly other, so use it alone rather. This could help a lot with what happens with your issue, since we could not yet reproduce it. You did try to set "checks.moving.velocity.graceticks" to something higher like 30, 40 ?