CreeperRadar and PacketWard: Joining the Dots

Hi, Paul here again, CEO of CreeperHost.

Put a Minecraft server on the public internet and it won't just be found by players.

There are scanners looking for open servers, bots trying whatever they find, and people looking for servers they can grief. Most of it isn't especially clever. A connection appears, tries to get in, then moves on to the next address.

Looking at one server, that can be difficult to tell apart from somebody with the wrong Minecraft version or a missing mod. Looking across our whole network, the pattern is much clearer.

We've built CreeperRadar to join those dots. We've also released PacketWard, a free, open-source server mod that lets people outside CreeperHost use the useful part too.

What CreeperRadar Actually Does

A failed login on its own means almost nothing. Anyone who has played modded Minecraft has connected with the wrong setup at least once. Blocking somebody for that would be daft.

The useful bit is seeing the same IP behave the same way across unrelated servers. Two odd connections on one server are easy to ignore. The same thing across several servers is not.

CreeperRadar collects small reports from Minecraft services across CreeperHost when a login either succeeds or is rejected. That includes connections which get far enough to try logging in but never become a player on the server.

It then looks at how widely the activity is spread, whether it keeps happening, and whether the attempts are getting in or mostly failing. From that, it assigns a risk level from one to five, with an expiry.

I'm not publishing the exact scoring rules or timing. This should explain the design without helping somebody tune a scanner against it.

The reports are sent in the background. Minecraft doesn't wait for CreeperRadar before letting somebody join, and CreeperRadar being unavailable won't stop a server starting or handling logins. Reporting can also be disabled for an individual CreeperHost service.

On CreeperHost services, blocking is handled at the operating-system level rather than by the Minecraft server. I won't go further into that side of it.

What We Keep

This system deals with IP addresses. Obviously, it has to.

We keep the connecting IP attached to every accepted report, including successful logins as well as rejected ones. CreeperRadar couldn't correlate activity otherwise. Live observations are removed after 90 days, and we keep seven rolling daily database backups.

What we don't need is a readable database of player names, UUIDs, customers, and which server each of them visited. We hash the reporting service, Minecraft instance, attempted name, and UUID separately, using a secret key, before storing them. That lets us recognise the same value again without keeping the original. We don't write the raw name, raw UUID, customer identity, or disconnect message.

PacketWard can't submit observations, and reports from outside the CreeperHost fleet are rejected. That leaves us enough information to tell when activity is related, without a readable list of who played where.

The public API doesn't hand out a blocklist of raw IP addresses. PacketWard gets a small set of possible matches with their risk and expiry, then does the full comparison locally.

We count public API use in daily totals. Those are kept for 90 days, with the requesting server's IP hashed rather than stored raw.

If we get one wrong, we can suppress the IP from both the public and CreeperHost results without deleting the evidence which led to it. If you think that's happened, please send it to CreeperHost support privately rather than posting the IP in a public issue.

PacketWard

PacketWard is a small server-only mod. Players don't install anything.

When a connection arrives, PacketWard checks it before Minecraft spends time handling it. A full match at or above the level chosen by the server owner is dropped; anything else carries on normally.

If a Minecraft update breaks that early check, PacketWard logs a warning and uses its fallback rather than crashing the server.

PacketWard only reads from the public side of CreeperRadar. It doesn't report player joins, failed logins, names, UUIDs, or server activity back to us.

The IP being checked isn't sent to the API either.

PacketWard hashes it locally and sends a short piece of that hash. CreeperRadar replies with the possible matches for that small group, then PacketWard does the full comparison locally. Sharing the same short prefix isn't enough to block anybody; the complete hash has to match.

PacketWard doesn't transmit the raw IP or the complete hash it calculated. Lookup results are briefly cached in memory to avoid pointless repeat requests and aren't written to disk. It doesn't put the address or lookup details in the server log either.

CreeperRadar still sees the public IP of the server making the HTTPS request, because any web service would. The raw IP PacketWard is checking isn't included in that request. Those aren't necessarily the same thing.

If the API is down, PacketWard gets out of the way and allows the connection. Rate limiting is different: it denies the connection by default. You can change either behaviour and the minimum risk level in the config; setting the level to zero turns checks off.

Entries expire. PacketWard blocks levels four and five by default, and supports trusted TCP proxies for servers which use one.

What PacketWard Doesn't Do

PacketWard isn't going to solve every security problem. It isn't an anti-cheat, and it won't stop an IP that CreeperRadar has never seen. It doesn't replace updates, DDoS protection, sensible server configuration, or a whitelist if your server should be private.

What it can do is drop connections which match current higher-risk indicators before Minecraft spends CPU and bandwidth talking to them. It also cuts out some of the rubbish that would otherwise end up in the server log.

That's the job. Nothing more exciting than that.

Getting PacketWard

PacketWard is server-only and open source on GitHub under the Apache 2.0 licence.

There are builds for old Forge servers going back to Minecraft 1.7.10, as well as current Fabric, Forge, and NeoForge versions. Pick the file matching both your Minecraft version and mod loader, install it and the dependencies shown for that build, then start the server. Its config will be created on first run.

I'm a big supporter of open source anyway, but this one is especially simple. We're doing the work behind CreeperRadar for our own customers. We gain nothing by not sharing it, so PacketWard is free for the community to use.

You can choose and download the right PacketWard build on modpacks.ch. Players install nothing, and PacketWard doesn't report their joins to us.

- Paul (CEO, Founder, CreeperHost)