Nephthys - Mistress of the House
Goddess of your Unreal / Deus Ex / Rune / Unreal Tournament Server
Nephthys is a native mod for Unreal1 engine based servers which extends IpDrv by efficient attack blocking, banning, player logging, web redirection download support and other features.

- Contents / Legend
  - In Brief
  - Features
  - User Manual
    - Installation / Upgrade
    - Server Options / Netspeed Calculator / Web Support
    - General Web Options / Download Considerations
    - Client Options (Web Download)
    - Nephthys console commands
    - Nephthys ucc commandlet commands
    - Advice / How to handle attacks
    - Release History (New, Improvement, Change, Bug fix)
    - UScript interface
    - Disclaimer
    - Copyright / Permissions
  - Todo - not yet implemented/verified
- In Brief top ⇑

  Title | Nephthys
  Version | V1.5a011
  Description | Nephthys is a native mod for Unreal1 engine based servers which extends IpDrv by efficient attack blocking, banning, player logging and other features. Nephthys also provides efficient web downloads for clients and servers.
  Release Date | 22.08.2009
  Authors | Winged Unicorn, Zora
  Email Address | zzora@gamebox.net
  Filenames | Nephthys.zip
  DLLs | Nephthys.dll, IpDrv.dll
  Scripts | Nephthys.u, IpDrv.u
  Configurations | Nephthys.int, NephthysWebDownload.ini
  Game Compatibility | Unreal 224v, Unreal 225f, Unreal 226b (Gold), Unreal 226f, Deus Ex 1100 (1112fm), Rune 101, Rune 107, Rune 108 (108HoV), Unreal Tournament
  OS Compatibility | Windows 98/ME, Windows NT 4, Windows 2000, Windows XP, Windows Vista, Linux (Wine), Linux (Rune 107 and Rune 108 (108HoV) only)

- Features top ⇑
  - Integration
    - Nephthys may be combined with any game type and any other server mod running simultaneously
    - Pure server-side mod: the client does NOT need to download anything nor does even know that there's a security mod running
    - Nephthys may be installed independently at clients to profit by supported web download redirections
    - Remote admin control through admin commands
    - Native support of win32 Unreal 224v, Unreal 225f, Unreal 226b (gold), Unreal 226f, Deus Ex 1100 (1112fm), Rune 101, Rune 107, Rune 108 (108HoV), Unreal tournament
  - Attack blocking
    - Prevent the game from loading malicious packages
    - Limit number of players with same IP address
    - RJA (repetitive join attempt) attacks
      - Block only one IP, allow other IPs to reconnect, especially allow map change
      - don't log connection attempts from this IP address any more
      - kick all connections from this IP address since attack started (clean up)
      - don't kick attacking IP address (yet)
      - optionally insert ban entry automatically
      - recognize when attack has stopped
      - block RQA (repetitive query attempt) attacks as well
      - block RUA (repetitive uplink attempt) attacks as well
    - DRJA (distributed repetitive join attempt) attacks
      - Don't accept any new connections while under attack (reconnect is supported, even map change)
      - don't log anything
      - don't insert ban entries
      - kick all connections from since start of attack (clean up)
      - don't kick players
      - recognize when attack has stopped
      - block DRQA (distributed repetitive query attempt) attacks as well
      - block DRUA (distributed repetitive uplink attempt) attacks as well
    - RIA (repetitive injection attempt) attacks
      - don't log injection attempts from this connection any more
      - optionally kick attacking IP
      - optionally insert ban entry automatically
      - recognize when attack has stopped
    - IIA (illegal injection attempt) attacks
      - block the injection
      - optionally kick attacking IP
      - optionally insert ban entry automatically
    - RUF (repetitive unwanted function) attacks
      - don't log unwanted functions from this connection any more
      - optionally kick attacking IP
      - optionally insert ban entry automatically
      - recognize when attack has stopped
    - RBO (RPC bunch overflowed) plethora
      - don't log RPC bunch overflows from this connection any more
      - optionally kick attacking IP
      - optionally insert ban entry automatically
      - recognize when plethora has stopped
    - RLM (repetitive log messages) attacks
      - don't log messages from this connection any more
      - optionally kick attacking IP
      - optionally insert ban entry automatically
      - recognize when attack has stopped
  - Bug fixes / work arounds
    - Memory and CPU overloading attack ==> drop connection
    - Zombie (reconnect) bug attack ==> drop connection
    - Unreal engine format string bug attack ==> drop connection
    - Detect broken connections (ICMP port unreachable) ==> drop connection
    - Auto-closing multiple connections to same player to avoid server lag with reconnecting fast client computers
  - Banning
    - Banning blocks a connection before opening, so banned clients can't even download stuff from server and thus causing lag nor can do other harmful things
    - Bans may block the client's server query as well so the server becomes invisible to the banned client (stealth mode)
    - Banning by IP address (range)
    - Banning by Name
    - Timed bans
    - Quiet bans
    - Name reservation bans
    - Alert new ban entries
    - Alert applied bans
    - Alert disabled bans
    - Disable ban while admin online
    - Log any applied ban
  - Kicking
    - Drop connection immediately
    - Support kick of uploading / not yet established connections
  - IP log
    - Automatic logging of IPs and names (IP address ranges supported too)
    - Log by IP address (range)
    - Limit log to a fixed number of entries
    - Count various events
    - Admin command to ask for names of a known connection / IP address
  - File Upload
    - Alert uploads
    - Limit uploads to a configurable max. size per connection, reconfigurable during game-play
    - Limit uploads to a configurable max. size of package
    - Limit upload bandwidth to available bandwidth, possibly throttled down
    - Admin command to ask for details of progress
  - Web Download
    - Automatic download and extraction of needed files
    - Full compatibility between old and new servers and clients
    - Downloaded files are checked with Sha-2 (256) to be the same files currently running at the server
    - Servers provide lists of archives at web spaces where clients may download packages from
    - Clients use provided web download locations for fast, compressed downloads
    - Supports HTTP and FTP (active and passive)
  - Server Query
    - Additional server rules to display at advanced game clients (GameSpy, QTracker)
    - Player rules may report bots, spectators and cameras additional to real players
    - Attack blocking
  - Master Server Uplink
    - Attack blocking
    - Support custom-made master servers
  - UScript Interface (see documentation below)
    You may write an extension mod for Nephthys using this uscript API:
    - Events (UScript called by Nephthys)
      - New connection blocked
      - New connection created
      - New connection closed
      - PreLogin passed
      - File Upload
      - Login passed
      - Established connection closed (kick)
      - Logout passed
      - RJA started
      - RJA stopped
      - DRJA started
      - DRJA stopped
      - RIA started
      - RIA stopped
      - IIA detected
      - RUF started
      - RUF stopped
      - Repetitive connection attack started
      - Repetitive connection attack stopped
      - New ban entry inserted
      - Ban entry changed
      - Ban entry deleted
    - Functions (UScript calls Nephthys)
      - Add new ban entry
      - IpNameIsBanned?
      - Close connection (Kick)
      - Get info of given player
      - Get info of given connection (e.g. uploading file: name, current size, total size)
      - Delete ban entry
      - Get all ban entries for given IP/Name
      - Get all log entries for given IP/Name
      - IsDRJAAttack?
- User Manual top ⇑
  - Installation / Upgrade top ⇑
    Nephthys comes with an easy-to-use installer. For information and for trouble shooting here's the manual steps.
    Please read this section completely before you manually start to install / upgrade!
    If you are going to install Nephthys for Deus Ex then read "DeusEx" instead of "Unreal".
    If you are going to install Nephthys for Rune then read "Rune" instead of "Unreal".
    Take care of what Unreal version / game you use! These files are NOT compatible to other versions than given in the zip archive's full path names!
    1. Terminate your Unreal game server / client
    2. At first installation backup your `IpDrv.*` files of your `Unreal\System` folder
    3. Backup your server's `Unreal.ini` file of your `Unreal\System` folder
    4. Copy all new files to your `Unreal\System` folder, depending on the installed patch
    5. If your game runs on a different language than "int" (international) determine your language extension by opening `Unreal\System\Unreal.ini` with any text editor, e.g. Notepad and search for the line "language=" (without the quotes). Then copy `Unreal\System\Nephthys.int` to `Unreal\System\Nephthys.<your language extension>`.
    6. Edit your server's `Unreal.ini` file:
       Comment out UdpServerQuery (or KrbServerQuery) and add a new line, so that it looks like:
       `;ServerActors=IpServer.UdpServerQuery`
       `ServerActors=Nephthys.NptServerQuery`
       Comment out all UdpServerUplink lines and add new lines, so that it looks like:
       `;ServerActors=IpServer.UdpServerUplink MasterServerAddress=...`
       `ServerActors=Nephthys.NptServerUplink MasterServerAddress=...`
    7. Start your Unreal game server
    8. Take a look at your server console: You should see a startup message of Nephthys (you may have to scroll back - Nephthys is started in a very early position!). Furthermore, there shouldn't be any Nephthys warnings about misconfigurations!
    9. If you run your server with UProtect you have to set Advanced Options -> Nephthys -> Nephthys Server -> Udp Server Query -> Settings -> bNoSmurfPingPong=false.
    If there was a previous Nephthys version installed, the new Nephthys version automatically will preset new settings to default values. Values of existing settings are preserved. There aren't any manual steps to do.
    For clients which want to profit from Nephthys' web download feature and for servers which want to support Nephthys' web download feature, please follow these additional steps:
    1. For extraction from .zip and .rar archives:
       1. Download the freeware 7-Zip archive decompression and extraction utility from http://www.7-zip.org/.
       2. Install 7-Zip to anywhere you want (or to the suggested default folder).
    2. For extraction from .ace archives either
       a) Copy `zunace.exe` and `unacev2.dll` to your `Unreal\System` folder.
       - or -
       b) Copy both to any folder you want and extend the environment path variable to that folder.
    3. Either
       a) Copy `zxumod.exe` to your `Unreal\System` folder
       - or -
       b) Copy it to somewhere else and extend the environment path variable to that folder.
       `zxumod` is a simple command line tool to extract files from Unreal modules (`.umod` archives) to given folders.
    See General Web Options / Download Considerations for general details of web configuration, Server Options (Web Support) for additional server side web configuration and Client Options (Web Download) for additional client side web configuration.
    Since Unreal patch 224v clients/servers have an option count limit all web support/download options are defaulted. Thus, web support/download can't be used with Unreal patch 224v. Unreal servers may use Unreal patch 225f for best compatibility. Unreal clients may use Unreal patch 226f or Unreal Gold.
  - Server Options top ⇑
    Nephthys' server side settings can be customized in server's Advanced Options -> Nephthys -> Nephthys Server. These settings only apply for server side installations. Nephthys' default settings will work fine for average servers, so if you are unsure about the configuration then just don't change anything ;-)
    - Nephthys Driver
      The Nephthys Driver extends the original IpDrv network driver. It controls all connections to joining / joined players.
      Additional to logging Nephthys may show various events to players, customizable by Show... (admins only) and ShowPublic... (other players only). Those options may have the following settings:

      Value | Description
      --- | ---
      ESM_DontEvenLog | Don't even log this event. This value is NOT recommended since even in the server log you can't see that Nephthys did something relevant. The usage of this value is only reasonable temporarily if a certain message is spamming the server log. Please contact Zora or Winged Unicorn in this case. If you choose this option value Nephthys is logging a warning after startup.
      ESM_Off | Don't show this event. If you just like to enjoy playing without getting informed how Nephthys works, then use this value everywhere.
      ESM_Silent | Show this event without beep. If you think Nephthys beeps too much, then use this value instead of ESM_Beep.
      ESM_Beep | Show this event and beep. If you usually ignore the chat and want to be beeped by Nephthys' events, then use this value instead of ESM_Silent.

      Also, the reaction to some attack detections may be configured ny React.... Those options may have the following settings:

      Value | Description
      --- | ---
      EAR_Off | The attack is detected but Nephthys doesn't interact. This value is NOT recommended since your server is vulnerable to a known exploit.
      EAR_Block | The attack is detected and blocked by Nephthys.
      EAR_Kick | The attack is detected, blocked by Nephthys and the causing connection is closed (that means, the causing player is kicked; kick by IP address (range)).
      EAR_Ban | The attack is detected, blocked by Nephthys, the causing connection is closed and a ban for the causing IP address (range) is added/re-activated.
      EAR_BanQuiet | The attack is detected, blocked by Nephthys, the causing connection is closed and a quiet ban for the causing IP address (range) is added/re-activated.

      Options:
      - Attacks
        For general considerations please read the section How to handle attacks!
        - DRJA - Distributed repetitive join attempts. Known as fake player attack, recognized by fast joining "Test" players, from multiple different IP addresses. This is a DoS (denial of service) attack attempt.

          Option | Default | Description
          --- | --- | ---
          ConnCountForDRJA TimeDeltaForDRJA | 50 1 | Max. number of new connections per TimeDeltaForDRJA seconds counted for all IPs, more than this is considered to be a DRJA (distributed repetitive join attempt) attack, resulting in ignorance of all further join attempts until the attack is over. Set ConnCountForDRJA to at least (MaxPlayers + MaxSpectators) * 1½ to allow proper map travels for all players. Set it even higher to avoid unnecessary DRJA detections in minor attack situations. Consider the DRJA detection as the last emergency brake before the server crashes.
          ShowDRJA | ESM_Beep | How to show detected DRJA attacks to all admins
          WhiteListMode | EWLM_AutoQuiet | How to allow certain players to join during DRJA attacks:
          Value | Description
          --- | ---
          EWLM_Off | No white list is used
          EWLM_AutoLogBlocked | White list is used automatically, all blocked connections are logged
          EWLM_AutoQuiet | White list is used automatically, blocked connections are not logged
          EWLM_AlwaysLogBlocked | Only white list players can join, all blocked connections are logged
          EWLM_AlwaysQuiet | Only white list players can join, blocked connections are not logged

        - General - General attack settings.

          Option | Default | Description
          --- | --- | ---
          AutoBanDeleteSeconds | 2419200 | Number of seconds after which an automatically inserted ban is removed automatically (see "Delete" parameter in ban new). 2419200 = 4 * 7 * 24 * 3600 (4 weeks). 0=off=endless bans.
          MaxLoginsPerIP | 0 | Maximum allowed number of concurrent successful logins per IP (0=off=infinite).

        - IIA - Illegal injection attempts. This attack may spam the server log and cause lag or may crash the server. This is a DoS (denial of service) attack attempt.
          These settings aren't configurable for 224v: Nephthys uses the default settings here.
          Repetitive illegal injection attempts (RIIA) are treated like RIA attacks (see below).

          Option | Default | Description
          --- | --- | ---
          ReactIIA | EAR_Kick | How to react when a IIA attack is detected
          ShowIIA | ESM_Beep | How to show detected IIA attacks to all admins

        - RBO - RPC bunch overflowed. This plethora may spam the server log and cause lag. This might be exploited as a DoS (denial of service) attack attempt.
          These settings aren't configurable for 224v: Nephthys uses the default settings here.

          Option | Default | Description
          --- | --- | ---
          CountForRBO TimeDeltaForRBO | 10 10 | Max. number of RPC bunch overflows per TimeDeltaForRBO seconds counted for a single connection, more than this is considered to be a RBO (RPC bunch overflowed) plethora.
          ReactRBO | EAR_Kick | How to react when a RBO plethora is detected
          ShowRBO | ESM_Beep | How to show detected RBO plethoras to all admins

        - RER - Repetitive exception recovery. Some network packet processing may cause a crash due to an engine bug. Nephthys tries to recover from those exceptions. However, this might be exploited by spamming the server log and cause lag resulting in a DoS (denial of service) attack attempt.
          These settings aren't configurable for 224v: Nephthys uses the default settings here.

          Option | Default | Description
          --- | --- | ---
          CountForRER TimeDeltaForRER | 10 20 | Max. number of exception recoveries per TimeDeltaForRER seconds counted for a single connection, more than this is considered to be a RER (repetitive exception recovery) attack.
          ReactRER | EAR_Kick | How to react when a RER attack is detected
          ShowRER | ESM_Beep | How to show detected RER attacks to all admins

        - RIA - Repetitive injection attempt. This attack may spam the server log and cause lag. This is a DoS (denial of service) attack attempt. A typical injection is the "netspeed ddd" command.
          These settings are used for RIIA (repetitive illegal injection attempts) as well.
          These settings aren't configurable for 224v: Nephthys uses the default settings here.

          Option | Default | Description
          --- | --- | ---
          CountForRIA TimeDeltaForRIA | 10 10 | Max. number of injection commands per TimeDeltaForRIA seconds counted for a single connection, more than this is considered to be a RIA (repetitive injection attempt) attack.
          ReactRIA | EAR_Block | How to react when a RIA attack is detected
          ShowRIA | ESM_Beep | How to show detected RIA attacks to all admins

        - RJA - Repetitive join attempts. Known as fake player attack, recognized by fast joining "Test" players, from single IP address. This is a DoS (denial of service) attack attempt.

          Option | Default | Description
          --- | --- | ---
          AutoBanBitsRJA | 8 | Used to detect and ban not only a single attacking IP address but a wider range (subnet detection and banning). Higher values make the detection more fuzzy: catch more and ban more. Lower values make the detection more exact. A value of 0 only catches and bans a single IP address. Values above 16 hardly make any sense since the detection would catch and ban almost the entire internet at once. 32 is the max. usable value. E.g. a value of 8 catches and bans the IP range x.x.x.0-x.x.x.255, 16 would catch and ban x.x.0.0-x.x.255.255, etc.
          ReactRJA | EAR_Kick | How to react when RJA attack is detected
          ConnCountForRJA TimeDeltaForRJA | 10 10 | Max. number of new connections per TimeDeltaForRJA seconds counted for a single IP, more than this is considered to be a RJA (repetitive join attempt) attack, resulting in ignorance of all further join attempts from this IP address until the attack is over. Set ConnCountForRJA to at least (max. remote lan players) * 1½ to allow proper map travels for all remote lan players.
          ShowRJA | ESM_Beep | How to show detected RJA attacks to all admins

        - RLM - Repetitive log message. This attack may spam the server log and cause lag. This is a DoS (denial of service) attack attempt. Every server log message denoting a somehow critical event or a known possibility to spam the server log by a normal player's action is considered.
          These settings aren't configurable for 224v: Nephthys uses the default settings here.

          Option | Default | Description
          --- | --- | ---
          CountForRLM TimeDeltaForRLM | 20 10 | Max. number of log messages per TimeDeltaForRLM seconds counted for a single connection, more than this is considered to be a RLM (repetitive log message) attack.
          ReactRLM | EAR_Kick | How to react when a RLM attack is detected
          ShowRLM | ESM_Beep | How to show detected RLM attacks to all admins

        - RUF - Repetitive unwanted function. This attack may spam the server log and cause lag. This is a DoS (denial of service) attack attempt.
          These settings aren't configurable for 224v: Nephthys uses the default settings here.

          Option | Default | Description
          --- | --- | ---
          CountForRUF TimeDeltaForRUF | 10 10 | Max. number of unwanted functions per TimeDeltaForRUF seconds counted for a single connection, more than this is considered to be a RUF (repetitive unwanted function) attack.
          ReactRUF | EAR_Kick | How to react when a RUF attack is detected
          ShowRUF | ESM_Beep | How to show detected RUF attacks to all admins

      - Banning - settings of the banning module

        Option | Default | Description
        --- | --- | ---
        ShowBan | ESM_Beep | How to show any change of the ban table to all admins
        ShowSuspect | ESM_Silent | How to show any matching rules not applied due to (temporary) deactivation to all admins

      - Commands - settings for remote command interface

        Option | Default | Description
        --- | --- | ---
        ShowCmdError | ESM_Beep | How to show errors while executing remote admin commands. If your server is always accessible by server console you may set this option to ESM_Off.
        ShowCmdResult | ESM_Silent | How to show results of remote admin commands. If your server is always accessible by server console you may set this option to ESM_Off.

      - Connections - settings concerning player connections

        Option | Default | Description
        --- | --- | ---
        bKillDoubles | true | Whether to kill double connections to players with same IP address / Name to get rid of unused (bandwidth eating) connections quickly. This may cause players with same IP address having to connect one after each other, not both at once. See also KillDoubleDelay.
        bRejectAfterGameEnd | false | Whether to reject new connections when the game is ended (GameType.bGameEnded == true). This may cause a server to reject all connections if the map doesn't switch automatically after the game ended.
        KillDoubleDelay | 10 | How long (in seconds) bKillDoubles is disabled after a map change. This allows remote LAN players to travel at once into new map. Compatibility with Nephthys V1.0: 0.
        LogWithIP | ELWI_Critical | What events to log with the IP address of the causing connection. This option easily allows to isolate the causing player of a certain server log line. Possible settings:
        Value | Description
        --- | ---
        ELWI_Off | Server log messages never log additional connection informations
        ELWI_Critical | Critical server log messages log additional connection informations
        ELWI_Always | All log messages log additional connection informations
        RecvErrorsToClose | 2 | Connection is closed after this number of successive receive errors. Usually 1 should do well, but some routers / PCs (?) seem to send single ICMP error messages spuriously. Set this to 0 to turn it off (not recommended). Compatibility with Nephthys V1.0: 0.
        RegardPrivateICMP | ERPI_Auto | (not available for 224v) Whether to regard ICMP "port unreachable" messages from private and APIPA IP addresses. Set this option to ERPI_Always only if your server either only supports LAN players (private and APIPA IP addresses) or only supports remote players (no private nor APIPA IP addresses). Since most cheap xDSL routers don't apply proper NAPT of ICMP packets a LAN connection may be closed by a closing remote player connection if you turn this option to ERPI_Always and mix LAN and remote players. ERPI_Auto switches dynamically to "regard" if either only private or only public IP address connections are opened and back as soon as mixed connections are opened. ERPI_Off doesn't ever regard any private ICMP message. For more information see rfc1918 for private addresses, see rfc3330 for special used IPv4 addresses, see rfc2663 and rfc3022 for correct NAPT of ICMP packets.
        ShowBlock | ESM_Beep | How to show connection blocks to all admins.
        ShowInvalidData | ESM_Off | How to show invalid data from a connection (which might cause a Zombie bug).
        ShowKick | ESM_Beep | How to show kicks to all admins.
        ShowLogin | ESM_Off | How to show player logins to all admins. This is usually done by the game type.
        ShowLogout | ESM_Off | How to show player logouts to all admins. This is usually done by the game type.
        ShowNew | ESM_Silent | How to show upcoming connections to all admins.
        ShowPreLogin | ESM_Beep | How to show player prelogins to all admins.
        ShowPrivateICMP | ESM_Off | (not available for 224v) How to show ignorance of private and APIPA IP addresses to all admins (see option RegardPrivateICMP).

      - Customize - configuring Nephthys to be part of other server side mods

        Option | Default | Description
        --- | --- | ---
        bUscriptAPI | false | Whether to support the UnrealScript event interface. If there are mods using Nephthys' events this option has to be true, otherwise this option should stay false for better performance.

      - IP Log - settings of the player log module

        Option | Default | Description
        --- | --- | ---
        MaxLogTableEntries | 1000 | Limit for entry number in log table. On load oldest entries get deleted. Large log tables need much time to be saved and searched through. Small log tables can't store "old" players. Find an applicable value for your server. Use 0 to turn this option off (log table grows endlessly).
        ShowLog | ESM_Beep | How to show any change of the log table to all admins

      - Upload - settings concerning the upload of files down to a player

        Option | Default | Description
        --- | --- | ---
        bAllowUploads | true | If this is set to false no player may download missing packages.
        bLimitUploadBandwidth | true | Turns on the automatic upload bandwidth limitation algorithm. Upload is limited to the remaining available bandwidth calculated by MaxClientRate * (MaxPlayers + MaxSpectators) * UploadThrottle. If you prefer to play undisturbed by downloaders, this option should be set to true. If you prefer to get the downloader in as fast as possible (waiting until download/lag has stopped), this option should be set to false. To setup all your server's bandwidth values correctly use this small Netspeed Calculator (requires JavaScript to be enabled):
        Server's Bandwidth [kbit/sec]: |  | e.g. Modem=56, ISDN=64, T-DSL=128, etc. (if you have asymmetric bandwidthes enter the upload bandwidth, usually the smaller value!) If you're unsure ask your ISP or use the experimental way, e.g.: broadband » Speed tests. This value is related to your server computer's internet connection and not a setting of the Unreal server!
        MaxPlayers: |  | Advanced Options -> Game Settings -> MaxPlayers
        MaxSpectators: |  | Advanced Options -> Game Settings -> MaxSpectators
        MaxClientRate: |  | Advanced Options -> Networking -> TCP/IP Network Play -> MaxClientRate (= max. NetSpeed the server will accept from clients, 500 is lowest possible (very bad), 2600 is low, 5000 is medium, 20000 is LAN)
        Usage instructions: Always fill in the server's bandwidth. Fill in two of the Max... values and press enter to calculate the third Max... value. If you provide MaxPlayers and MaxSpectators then don't set your server's MaxClientRate higher than the calculated value. If you provide the desired netspeed then don't set your server's MaxPlayers or MaxSpectators higher than the calculated value.
        MaxUploadPackageSize | -1 | Max. number of bytes a package may have to be allowed to be uploaded. Greater amount is blocked before start. -1 = no limit
        MaxUploadSize | -1 | Max. number of bytes a connection may download in sum. Greater amount is blocked before start. -1 = no limit
        ShowPublicUploads | ESM_Off | How to show a lag warning due to uploads to all players but admins.
        ShowUploadDone | ESM_Off | How to show info about completed uploads to all admins.
        ShowUploads | ESM_Beep | How to show info about uploads to all admins.
        UploadThrottle | 1.0 | Multiplyer for automatic upload bandwidth limitation (needs bLimitUploadBandwidth=true). Values > 0.0 but < 1.0 will make downloads slower with less lag for online players, values > 1.0 will make download faster with increasing lag for online players, values <= 0.0 will disable uploads. See bLimitUploadBandwidth for more details.

      - Web Support - support clients by providing download informations
        To allow clients to use the web download feature it has to be enabled at the server and the admin has to setup a list of web downloadable archives with a list of included packages each. See the command web support <url> how to setup web stored archives.
        Usually the admin doesn't have to upload any archive to anywhere and the admin doesn't need to have any web space if the admin can find a web located archive including the required packages. Of course, if the server runs own custom maps/mods it's a good idea to upload them to some web space and setup appropriate URLs to them as well. An archive may be of type 7z, ZIP, RAR, ACE or UZ. It may contain a single Unreal package or multiple packages which are bundled logically. You can bundle single maps with their needed packages (textures, sounds, songs, etc.) or you can bundle entire episodes (multiple maps, textures, songs, etc.). The archive doesn't need to include any map at all.
        The Unreal client has to be able to download the archive from the given URLs without need of any user interaction (e.g. some sites require the user to enter characters shown in a picture; those sites won't work), no logins, no "click here to continue download", no "download should start automatically in a few seconds" (JavaScript) etc. The admin easily may verify that by entering the URL (copy and paste) into the address line of an internet browser. If the download starts without any additional user interaction, then Unreal clients should be able to download as well.
        If your public server computer doesn't support installation of custom mods (e.g. if you admin a rented server which only allows you to upload files) you can install Nephthys to your local computer and upload the files as given in the manual installation instructions to your public server computer. To setup URLs for the web support feature you can add the URLs to your local computer using the web support <url> command and just copy the resulting `NephthysWebDownload.ini` file to your public server (requires restart of your public server to apply). In this case using Nephthys Lite instead of Nephthys on the public server computer is recommended, especially if the public server computer doesn't allow Nephthys to be able to launch extractor programs.
        These settings aren't configurable for 224v: Nephthys uses the default settings here.

        Option | Default | Description
        --- | --- | ---
        bSupportWebDownload | true | The server side master switch. If this option is set to false the server won't ever support any web download (i.e. the server won't provide any URL to any client).
        DownloadFolders | <empty> | To setup a list of URLs referring archived packages use the command web support (see there). However, if you already have folders where you downloaded lots of archives you may enter these folder names to the DownloadFolders so the setup process doesn't need to re-download these archives just to take a look into which packages are contained. DownloadFolders are to be considered readonly for Nephthys. Its only purpose is to optionally provide a list of already downloaded archives. The folder names may be given relatively to the Unreal system folder.
        ServerOnlyPackages | <empty> | An array of all packages which never should be provided download urls for even if an archive is known. Don't add the file extension here (e.g. if your server mod is called "MyServerMod1.u" then only enter "MyServerMod1" here). Nephthys itself is always considered to be a member of this list, so you don't need to add "Nephthys" here. Also, all other ServerActors not listed in ServerPackages are considered to be a member of this list automatically.

    - Master Server Uplink
      The master server uplink is the server side actor which registers the server at the master server(s) (e.g. gamespy), so all other players can see the server in the global server list.
      Note that NptServerUplink has its own settings here. The settings at Advanced Options -> Networking -> Master Server Uplink do NOT apply for NptServerUplink actors.
      Nephthys has its own actor which supports custom-made master servers (see below) and fixed some flaws:
      - Settings - General options:

        Option | Default | Description
        --- | --- | ---
        bBanRUA | false | whether to ban an RUA attacking IP address automatically
        bBerateFakeMasters | true | whether to send a berating message to fake masters, i.e. remote partners which query an "outgoing" uplink port instead of querying the proper query port. The berating message is localizable in `Nephthys.int`.
        bLogAllRequests | false | debug only, never set this to true for usual play!
        bLogInvalidRequests | false | log mal-formed requests
        bLogRejected | false | log attacker requests
        bLogSendFail | true | log failing sends
        bLogSendText | false | debug only: log all replies sent
        DoUplink | true | whether to uplink to the given master server, so the server is globally listed. Note that NptServerUplink has its own setting here.
        UpdateMinutes | 1 | How often NptServerUplink uplinks to the master server. Note that NptServerUplink has its own setting here.
        MasterServerAddress MasterServerPort | master0.gamespy.com 29700 | These settings are usually overridden by specific ServerActors=Nephthys.NptServerUplink... lines, so it need not be configured here.
        MaxRequestsForDRUA TimeDeltaForDRUA | 20 1 | max. numer of requests per TimeDeltaForDRUA seconds counted of all IPs, more than this is considered to be a DRUA (distributed repetitive uplink attempt) attack, resulting in ignorance of all further requests. This is a DoS (denial of service) attack attempt. To take effect, it must be: MaxRequestsForDRUA * TimeDeltaForDRUA <= MaxTicksPerSecond.
        MaxRequestsForRUA TimeDeltaForRUA | 7 1 | max. number of requests per TimeDeltaForRUA seconds a single IP address may do, more than this is considered to be a RUA (repetitive uplink attempt) attack. This is a DoS (denial of service) attack attempt. To take effect, it must be: MaxRequestsForRUA * TimeDeltaForRUA <= MaxTicksPerSecond.

      If, one day, the master server is turned off, this game won't be totally doomed yet. In fact, anyone - for example, you - will be able to run a master server by doing this:
      - upgrade to the latest version of Nephthys
      - run UCC masterserver
      Moreover, in order for the remaining U1 servers to get bound to the new "personal" master servers, server admins will have to:
      - upgrade to the latest version of Nephthys
      - add this line to their server's ServerActors:
        `ServerActors=Nephthys.NptServerUplink MasterServerAddress=<domain or IP address of (your) new master server> MasterServerPort=<port>`
      Finally, clients will also have to update their Unreal.ini to look up at the new master server by adding this line:
      `[UBrowserAll]
      ListFactories[0]=UBrowser.UBrowserGSpyFact,MasterServerAddress=<domain or IP address of (your) new master server>,MasterServerTCPPort=<port>,GameName=Unreal`
    - Udp Server Query
      The UDP server query is the server side actor which replies to client's info requests (mainly server rules (= admin name, which map is running, ping. etc.) and player list (= which players are currently playing, scores, skins, pings, etc.)).
      Nephthys has its own actor which fixed some flaws and has some more options:
      - Reports - Displayed by enhanced server browsers (= not the in-game browser, e.g. GameSpy or QTracker) Nephthys can reply additional informations:

        Option | Default | Description
        --- | --- | ---
        AddServerRule | <all empty> | generic additional informations given to the client as reply to server rule requests
        .Tag |  | the key for the information (e.g. "Policy")
        .Value |  | the information itself (e.g. "No cussing!")
        bCountRealPlayersOnly | true | whether to count real players in server list only (= don't count spectators, etc.) or to count all of the checked above in server list
        bReportBots | false | include bots in detailed info
        bReportCameras | false | include cameras in detailed info
        bReportMeshSkinFace | true | whether to report meshes, skins and faces (Deus Ex only) of players
        bReportOthers | false | include all other score board entry relevant actors in detailed info
        bReportPlayers | true | include players in detailed info
        bReportSpectators | false | include spectators in detailed info

      - Settings - General options:

        Option | Default | Description
        --- | --- | ---
        bAcceptIllegalSyntax | false | whether to accept illegal query syntax (not conform to the GameSpy Query Protocol). It's not recommended to set this to true because it's inefficient and certains query requests won't work. Only needed to support some wrongly coded game-external third-party server query tools. For Rune this is always considered to be set to true.
        bBanRQA | false | whether to ban an RQA attacking IP address automatically
        bDisableProperties | false | whether to reject requests of named properties of the game, the level or the players
        bLogAllRequests | false | debug only, never set this to true for usual play!
        bLogInvalidRequests | false | log mal-formed requests
        bLogInvalidSends | true | log mal-formed replies
        bLogRejected | false | log attacker requests
        bLogSendFail | true | log failing sends
        bLogSendText | false | debug only: log all replies sent
        bNoSmurfPingPong | true | Prevents servers from playing query ping-pong caused by a smurf attack. If you use UProtect you have to set this option to false.
        bReplaceBackslashes | true | whether to replace all backslashes '`\`' to slashes '`/`' in query responses
        MaxRequestsForDRQA TimeDeltaForDRQA | 20 1 | max. numer of requests per TimeDeltaForDRQA seconds counted of all IPs, more than this is considered to be a DRQA (distributed repetitive query attempt) attack, resulting in ignorance of all further requests. This is a DoS (denial of service) attack attempt. To take effect, it must be: MaxRequestsForDRQA * TimeDeltaForDRQA <= MaxTicksPerSecond.
        MaxRequestsForRQA TimeDeltaForRQA | 7 1 | max. number of requests per TimeDeltaForRQA seconds a single IP address may do, more than this is considered to be a RQA (repetitive query attempt) attack. This is a DoS (denial of service) attack attempt. To take effect, it must be: MaxRequestsForRQA * TimeDeltaForRQA <= MaxTicksPerSecond.

  - General Web Options / Download Considerations top ⇑
    The client as well as the server may connect to some web space due to the web download feature. The client connects when it needs to download archives containing needed packages (requires bEnableWebDownload=true), the server only during automatic setup using the command web support <url> (requires bSupportWebDownload=true). Nephthys Lite servers never connect to download an archive. Both, client and server, need to have Nephthys installed to make the web download feature work. If either or both of them doesn't run the Nephthys web download feature, the download will be done as before, i.e. directly from the Unreal server. Options for this generic web access are configured here. Since it's only one set of options for client and server, you can't have different settings for client and server when running both from within the same Unreal system folder (e.g. if you run a listening client as server).
    General web download settings can be customized in Advanced Options -> Nephthys -> Nephthys Web. These settings apply for both, server and client side installations. The default settings will work fine for average servers and clients, so if you are unsure about the configuration then just don't change anything ;-)
    These settings aren't configurable for 224v: Nephthys uses the default settings here.
    - Web Download - basic web download settings.

      Option | Default | Description
      --- | --- | ---
      ArchiveFolder | ..\NephthysDownloadedArchives | The folder where to download archives to. May be given absolute (starting with a device letter) or relative (as the default). Relative pathes refer to the Unreal system folder. With the very first startup Nephthys presets this setting to the default value and creates the needed folder. If you change this setting later (e.g. to share the download folder with multiple Unreal installations), you have to create the new folder by yourself (and then you can safely delete the folder created by Nephthys). Also note that for security reasons this path always must end with `\NephthysDownloadedArchives`.
      bDeleteArchiveWhenDone | false | Whether to delete the download archive after the needed packages were extracted. If you set this option to true and bExtractAllPackages=false, clients will have to download the archive again and again for every map which is included in the archive. If you run out of hard drive space then set this option to true.

    - Web Download (FTP) - special settings concerning FTP download
      Near HTTP FTP is the second most used method to retrieve maps from web spaces. FTP is a little more difficult than HTTP because two connections are needed and some client side personal firewalls or routers may complain about even that. Read through these options to determine how to setup your firewall/router to make it work.

      Option | Default | Description
      --- | --- | ---
      ActiveDataPort | <empty> | If this option is empty, passive FTP is used (the FTP client opens 2 outgoing connections to the web server, the control connection to the remote port 21 (usually, but some web spaces may use other ports), and the data connection to a remote port given by the web server). To enable active FTP you have to enter a local port number or a number range (with a dash inbetween the 2 numbers) which is/are to be used by the web server for incoming data transfer. For passive FTP you need to allow Unreal to open outgoing TCP connections to any remote address and any remote port. For active FTP you need to allow Unreal to open outgoing TCP connections to any remote address and remote port 21 (usually, but some web spaces may use other ports) and to accept incoming TCP connections to the local port(s) you provided in this option.
      AnonymousEmail | name@example.com | By common sense, FTP clients should provide their email address to the FTP web server from which they download stuff from. Most FTP web servers accept any password for anonymous connections while some only accept a valid email address. If this option is empty, "guest" is used as password to login. Note that "example.com" is invalid by definition (see rfc2606).
      bRedownloadArchives | false | Whether to download archives again, although they already exist in the ArchiveFolder. Useful, if the archive at the web space got updated but didn't change its size.
      FtpRetryPause | 3 | Time in seconds to wait after any failure of an FTP connection before retrying. Too low times may be treated as attacks by the web server and may lead in permanent banning.
      FtpTimeout | 20 | Time in seconds to wait for web server replies.
      MaxFtpConnsPerServer | 1 | If multiple archives are to be downloaded from the same web server Nephthys opens multiple connections and downloads them at once. Many web servers limit the number of connections per FTP client though, leading to a timeout error at the FTP client side. To avoid unnecessary timeout errors the number of connections per web server may be limited with this option. Nephthys then loads the required archives sequentially.
      MaxParallelFtpConns | 5 | How many FTP connections maximal are opened at once if multiple archives are to be downloaded.
      MaxRetryCount | 5 | Maximum number of tries after failing FTP downloads. If this number is exceeded Nephthys gives up and falls back to the standard download (from the Unreal server).

    - Web Download (HTTP) - special settings concerning HTTP download
      HTTP is the most popular method to retrieve maps from web spaces. To allow Unreal to use HTTP web download it need to be allowed to open outgoing TCP connections to any remote address and remote port 80 (usually, but some web spaces may use other ports).

      Option | Default | Description
      --- | --- | ---
      bRedownloadArchives | false | Whether to download archives again, although they already exist in the ArchiveFolder. Useful, if the archive at the web space got updated but didn't change its size.
      HttpRetryPause | 3 | Time in seconds to wait after any failure of an HTTP connection before retrying. Too low times may be treated as attacks by the web server and may lead in permanent banning.
      HttpTimeout | 20 | Time in seconds to wait for web server replies.
      MaxHttpConnsPerServer | 1 | If multiple archives are to be downloaded from the same web server Nephthys opens multiple connections and downloads them at once. Many web servers limit the number of connections per HTTP client though, leading to a timeout error at the HTTP client side. To avoid unnecessary timeout errors the number of connections per web server may be limited with this option. Nephthys then loads the required archives sequentially.
      MaxParallelHttpConns | 5 | How many HTTP connections maximal are opened at once if multiple archives are to be downloaded.
      MaxRedirectionCount | 5 | Locations of archives may be redirected by the web server. This option limits endless redirection chains.
      MaxRetryCount | 5 | Maximum number of tries after failing HTTP downloads. If this number is exceeded Nephthys gives up and falls back to the standard download (from the Unreal server).

    For general information and hints for trouble shooting please read:
    - The web download feature doesn't download from the Unreal server but from a third-party web space.
    - The Unreal server's internet line isn't used for the download. The Unreal server's bandwidth isn't affected.
    - The web download feature is fully compatible to supporting and non-supporting clients and servers.
    - Clients only profit by the web download feature if the server supports it by providing appropriate download URLs.
    - The Unreal server doesn't need to upload anything if the supported archive already exists at some web space.
    - The referred archive may be of type 7z, ZIP, RAR, ACE or UZ.
    - Clients only download the archive once, even if its provided more than once by the server.
    - Extracted packages are checked to be the same which are currently running at the server (by SHA-2(256) checksum). However, the package bit for allowing upload isn't included by that check and maps may differ only by 226-224/225 compatibility.
    - Multiple needed archives are downloaded and extracted simultaneously.
    - During concurrent actions the client's progress display switches between the concurrent actions about every 2 seconds.
    - Use a virus guard checking every archive. Although Nephthys doesn't extract non-Unreal packages, the archive could still contain viruses or other malware which could be opened accidentally.
    - For stability reasons Unreal doesn't extract the archives by itself but uses external programs.
    - If the server doesn't ever run any custom package which should be downloaded by the client then the server doesn't ever need to support the web download feature.
    - Since the server only connects to web spaces during the web support command you don't need to setup permanent firewall rules for the server but may allow those accesses only manually on demand.
    - As server use Nephthys Lite instead of Nephthys if the hosting computer doesn't allow Nephthys to be able to launch extractor programs.
    - Some firewalls alert if a process tries to start another process. To use web download, Unreal needs to be allowed to start the decompression tools.
    - To locate any troubles you first should look at the Unreal log file (usually it's `C:\Unreal\System\Unreal.log`; or you press TAB, type showlog and press ENTER to open the in-game log console). Each web action lists a short summary here.
    - The log file lists some progress events, esp. the complete download URL.
    - Other supported freeware decompression tools are UnRAR for Windows (http://www.rarlab.com/, click at "Extras"), unzip (http://www.info-zip.org/) and PACL (Power Archiver Command Line, http://www.powerarchiver.com/download/#pacl).
    - You don't need to install all decompression tools. However, if there's no compression tool which handles the referred archive types, the archive can't be extracted.
    - To enable Unreal to call decompression tools by extending your environment path variable to any installation folder follow these steps (only do this if you're sure about it and understand what you're doing!):
      1. Press WINDOWS+PAUSE keys to open the System Properties
      2. Choose the "Advanced" register tab
      3. Click button "Environment Variables"
      4. In the upper list "User variables" there has to be a variable `PATH`:
      5. If `PATH` already exists, double click it and append the required installation folder (starting with the device letter) to it's Variable value, separated with a semicolon, e.g. `oldvaluehere;C:\Program Files\ThisDecompressionToolsFolder`.
      6. If `PATH` doesn't exist yet, Click the "New" button, enter "PATH" as the Variable name (without the quotes) and the required installation folder (starting with the device letter) as the Variable value, e.g. `C:\Program Files\ThisDecompressionToolsFolder`.
      7. Close the popups with the "Ok" buttons.
  - Client Options (Web Download)top ⇑
    Nephthys' client side settings can be customized in server's Advanced Options -> Nephthys -> Nephthys Client. These settings only apply for client side installations. Nephthys' default settings will work fine for average clients, so if you are unsure about the configuration then just don't change anything ;-)
    For safety you should set your client's .ini files to readonly if you found a proper configuration to prevent it from being changed accidentally or by malicious server admins (`Unreal.ini`, `User.ini`, `NephthysWebDownload.ini`).
    These settings aren't configurable for 224v: Nephthys uses the default settings here.
    - Web Download - settings to adjust the client side web download module

      Option | Default | Description
      --- | --- | ---
      bConvertAllToCache | false | Whether to convert all extracted packages to the cache folder using the appropriate naming conventions. Advantage: Avoid version mismatches. Disadvantage: The downloaded stuff can't be used offline. Todo: For now only the packages currently running at the server are converted to cache.
      bEnableWebDownload | true | The master switch. Set this option to false to turn off the web download feature at the client side.
      bExtractAllPackages | false | Whether to extract all packages (true, faster connect to next maps but slower connect to current map) or only the currently needed packages (slower connect to next maps, but faster connect to current map).
      bReplacePackages | false | Whether to replace existing packages with the same name (cache folder packages are never replaced).
      PackageFolder | ..\NephthysDownloadedPackages | The folder where to extract packages from download archives to. May be given absolute (starting with a device letter) or relative (as the default). Relative pathes refer to the Unreal system folder. With the very first startup Nephthys presets this setting to the default value and creates the needed folder. If you change this setting later (e.g. to share this folder with multiple Unreal installations), you have to create the new folder by yourself (and then you can safely delete the folder created by Nephthys). Also note that for security reasons this path always must end with `\NephthysDownloadedPackages`. All cache named packages always go to the cache folder though.
      WebLinkTimeout | 7 | The time the server is given to provide appropriate download URLs after it announced to support web download. If this time expires without support by the server the client falls back to the standard download procedure (download from the server).

  - Commands top ⇑
    Nephthys can be accessed from server log window via
    npt <command>
    or by in-game admins via
    admin npt <command>
    All commands' outputs are both, logged and shown to all admins, as configured by ShowCmdResult and ShowCmdError.
    The commands are NOT available for clients.

    Command | Description
    --- | ---
    Help | Show a brief summary of all commands
    Status [<conn#>|[-]<state>|[-]quiet] | Show a brief summary of all handled connections [a detailed info of given connection | all connections with [not] <state> | all [not] quiet connections]
    Ban list [<banentry> [<bansort> [<count> [overlap]]]] | List ban table [only <banentry>s [sorted by <bansort> [max. <count> entries [with overlapping bans]]]]
    Ban remove <banentry> | Remove ban table <banentry>s Hint: Use ban list with same <banentry> parameters prior to ban remove to avoid unwanted deletions
    Ban change <banentry> <banpar> | Change a single ban table <banentry> Hint: Use ban list with same <banentry> parameters prior to ban change to avoid unwanted changes
    Ban new <banpar> | Insert a new ban table entry, even if some banpars match an existing entry
    Kick <ip>[:<port>]|N=<Name>|O=<Computer>|I=<Identity> | Kick a given player (close its connection). You may kick downloaders by giving the IP!
    Log list [<logentry> [<logsort> [<count>]]] | List log table [only <logentry>s [sorted by <logsort> [max. <count> entries]]]
    Log remove <logentry> [<name>] | Remove log table <logentry>s [only the exact <name> from the entry]
    Log range <logentry> <ipStart>[-<ipEnd>]|#<slotStart>-<slotEnd>[,Mask] | Expand log table entry to IP address range / re-range <logentry>. New range may include other entries, but must not intersect any entry. Giving ",Mask" will expand the selected range to boundaries of powers by 2 (see <logentry>). If you're unsure what this option does then don't use it! Anyways, it's recommended to use "log list" with this required mask prior to applying it with "log range".
    Log merge <logentry> [Mask] | Merge successive <logentry>s with same name(s) [and expand them by mask calculation]. It's a shortcut to range multiple log table entries of dyn. IP address players into one single entry.
    Web support [<archive url>] | List the current web support state. If an archive url is given it is accessed and downloaded to the configured ArchiveFolder or examined locally (if found in the ArchiveFolder or in one of the DownloadFolders) and all Unreal relevant packages are memorized together with the archive url. Note that URLs are case sensitive and must not include any blank character. The easiest and most convenient way is to copy the working URL from some web site or from your browser's address line directly to the server's log console window. This command with a given URL is not available in Nephthys Lite.
    Web list [<webentry>] | List web support table [only <webentry>s]
    Web toggle [<webentry>] | Enable/disable <webentry>s. Disabled web table entries are listed with a leading semicolon.
    Web remove [<webentry>] | Remove web table <webentry>s.

    With:

    Tag | Description
    --- | ---
    <banentry> | <ipStart>-<ipEnd> | #<slotStart>[-<slotEnd>] | N=<name> | L=<LastUsedStart>[-<LastUsedEnd>] | E=<ExpiresStart>[-<ExpiresEnd>] | D=<DeleteStart>[-<DeleteEnd>] | C=<comment> | M=<message> | R=<reference> | Drop | Stealth | Quiet | O=<Computer> | I=<Identity> More than 1 search criteria may be given separated by comma "," Name, Comment, Message, Reference, Computer, Identity: selects only ban entries including the given string LastUsed: The timestamp of the last time the ban rule was applied (setup by Nephthys automatically). You may omit time and/or day if not needed, e.g. 2004/08-2004/09 Expires: The timestamp of the epxiration of the ban rule (setup by Expires=...). You may omit time and/or day if not needed, e.g. 2004/08-2004/09 Delete: The timestamp of the time the ban rule is to be deleted automatically (setup by Delete=...). You may omit time and/or day if not needed, e.g. -2007/06 Drop: selects only ban entries with DropCount > 0 Stealth: selects only stealth ban entries Quiet: selects only quiet ban entries
    <bansort> | [-]<LastUsed> | [-]<Reference> LastUsed: sort the listed ban entries by their LastUsed information Reference: sort the listed ban entries by their Reference information precede the sort criterion with a minus sign to reverse the sort direction
    <banpar> | {IP=<ip>[-<ip>] | Name=<string> | | Expires=<stamp> | Delete=<stamp> | Mode=Always,OffWhenAdmin,ReserveName,Off | bStealth=0,1 | bQuiet=0,1 | Message=<string> | Reference=<string> | Comment=<string> | Next=#<slot>}+ IP: IP address (range) to ban, given as ddd.ddd.ddd.ddd Name: only for name bans (= ban if name matches) or name reservation bans (= ban if name matches but IP address (range) doesn't match) Expires: time stamp when this ban entry becomes disabled automatically and becomes shown as "suspect" if configured. Note that it isn't removed automatically! Delete: time stamp when this ban entry is to be deleted automatically. Note that the ban entry doesn't exist any more after that time stamp! Use this parameter to clean up the ban table automatically. Mode: Always: ban entry active always; OffWhenAdmin: ban entry active only if no admin is logged in; ReserveName (IP address (range) and Name requrired): Name is useable for given IP address (range) only; Off: disabled (is shown as "suspect" if configured) bStealth: 0: connection is allowed to query and to attempt PreLogin. The banned player is allowed to request a server info (name, players, scores, etc. are returned) and if the player tries to connect, Nephthys will let the player pass to PreLogin (so the admin (you) can see the Name of the player - important if you ban IP address ranges) and closes the connection after that. A higher mod has the possibility to send a (specific, see below) message to the player concerning the ban reason before Nephthys closes the connection. 1: no traffic from connection is accepted, i.e. the server will reject any server info request, so the server is invisible in the banned player's server list (NptServerQuery or a subclassed actor MUST be used; UdpServerQuery will not work). Also, if the player tries to connect manually by entering "open IP", Nephthys won't reply anything (just like a firewall: all network packets from the banned players are dropped). bQuiet: 0: Appliance of this ban is shown as configured in ShowBlock. 1: Appliance of this ban is neither shown nor logged at all. A customized uscript interface function is called though. Message (isn't considered for applying a ban; only used with non-stealth bans): message the player gets shown when banned. If no message is given the generic localized "BannedMessage" (section "[Nephthys]") in Nephthys.int is used. Reference (isn't considered for applying a ban): user defineable reference to the reason why this ban was setup (default and automatically inserted ban enties: current time stamp - see server log at this stamp for details) Comment (isn't considered for applying a ban): user defineable comment which should hold a reminder for the admin why this ban was setup. Next (may affect which ban is applied): If given the new or changed ban entry is placed before the given ban number, else it's appended at the end of the ban table (ban new) or it keeps its place (ban change). Since for ban application the ban table is scanned by slot number 0 to higher numbers, ban entries at the end of the ban table may be hidden behind a ban entry in a lower position.
    <logentry> | <ipStart>-<ipEnd> | #<slotStart>[-<slotEnd> | N=<name> | L=<LastUsedStart>[-<LastUsedEnd>] | Admin | Drop | Kick | O=<Computer> | I=<Identity>[,Mask] Name: selects only log entries including the given string LastUsed: omit time and/or day if not needed, e.g. 2004/08-2004/09 Admin: selects only log entries detected as admins Drop: selects only log entries with DropCount > 0 Kick: selects only log entries with KickCount > 0 Computer: selects only log entries for the given Unreal 227 client computer Identity: selects only log entries for the given Unreal 227 client identity Mask (requires IP address range or slot (range): extend IP address range to powers of 2. E.g. range 1.2.3.24-1.2.3.129,Mask becomes 1.2.3.0-1.2.3.255 and range 1.2.3.24-1.2.8.24,Mask becomes 1.2.0.0-1.2.15.255 etc. This might be useful when experimentally setting up IP address ranges for logged names of dynamic IP address address ranges.
    <logsort> | [-]<LastUsed> LastUsed: sort the listed log entries by their LastUsed information precede the sort criterion with a minus sign to reverse the sort direction
    <webentry> | #<slotStart>[-<slotEnd>]|<any fraction of the URL or any included package> Although URLs are case sensitive this command searches caseless.
    <string> | replace blanks with %20, % with %25
    <state> | Connection state. One of New, Reuse, Opened, Hello, PreLogin, Upload, Login, Closing, Condemn, Closed, Blocked
    <stamp> | yyyy[/mm[/dd[%20hh[:mm[:ss]]]]] Note that all time comparisons are simple string comparisons, i.e. "2004/12/31" < "2005/02/25" because "4" < "5" (as expected) but "31.12.2004" > "25.02.2005" because "3" > "2" (not wanted)

    Output notes:

    Command | Item | Description
    --- | --- | ---
    log list | P[reLogin] | counts how often a player reached the PreLogin state (before download / join).
    log list | L[ogin] | counts how often a player reached the Login state (successful join).
    log list | K[ick] | counts how often a player was kicked (manually).
    log list | D[rop] | counts how often a player's connection was dropped (invalid join parameters, stealth ban).
    ban list | S[tealthCount] | counts how often a stealth ban was applied. This value won't count for non-stealth bans, but may (re-) start to count if you change the stealth mode of a ban entry.
    ban list | D[ropCount] | counts how often a non-stealth ban was applied, i.e. how often the player was blocked in PreLogin. This value won't count for stealth bans, but may (re-) start to count if you change the stealth mode of a ban entry.

    Examples (IP addresses don't belong to real players):
    npt status
    Show status of all active / just closed connections (including incoming and uploading connections)
    npt status 2
    Show all names of the log entry matching for connection #2
    npt status login
    Show status of all successfully logged in connections
    npt status -blocked
    Show status of all but blocked connections
    npt log list 127.0.0.0-127.255.255.255
    npt log list 127
    List all log entries of localhost (= same computer the server is running on)
    npt log list #-20
    List first 20 log entries
    npt log list admin
    List all log entries for players who joined with the admin password
    npt log list N=ThisPlayer
    List all log entries including the player name 'ThisPlayer'
    npt log list L=2004/08-2004/09
    List all log entries last used in August 2004
    npt log list #- -last 30
    List last recently used 30 log entries (read: who were the last recently 30 players?)
    npt log range #123 #123-125
    Replace log entry 123 by merged log entries 123 to 125
    npt log merge #100-200
    Merge all successive log entries with same name in range 100 - 200. If one or both log entries have multiple names entries are merged as soon as one name matches.
    npt log remove #-
    Remove all log entries (do you have a backup?)
    npt ban list 192.168.47.3
    List all ban entries matching the IP address 192.168.47.3, including range ban entries where given IP address is included
    npt ban list N=ImStupid
    List all name ban entries matching for a player named 'ImStupid'
    npt ban list C=StupidPlayer
    List all ban entries with a comment including 'StupidPlayer'. It's a good idea to provide the player's name and a reason as a comment when entry is inserted.
    npt ban list #- -last 10
    List last recently applied 10 ban entries (read: who was kept out last night?)
    npt ban list #- -ref 5
    List last recently created 5 ban entries. Since the Reference value is used this only works correctly if a time stamp like in LastUsed is stored as Reference (default for automatically inserted ban entries).
    npt ban list E=-2005/12/31
    List all ban entries expired before the given date.
    npt ban list D=-2007/02/01
    List all ban entries which are deleted after the given date.
    npt ban list #- -last 1 overlap
    List the last recently applied ban entry and all other ban entries which overlap this one by IP address range. You might want to merge these to a single ban entry.
    npt ban new ip=127.0.0.1-127.0.0.255 comment=This%20is%20a%20Test! next=#0
    Insert a permanent stealth ban entry for localhost with the comment 'This is a Test!' at the first slot in the ban table
    npt ban new ip=127.0.1.1-127.0.1.255 mode=reservename bstealth=0 name=MyName
    Insert a name reservation ban for 'MyName': only given IP address range can join with that name at the last slot at the ban table (append)
    npt ban change C=StupidPlayer bStealth=0
    Sets a ban entry to non-stealth (keeping its position in the ban table)
    npt ban change 192.168.47.3 Mode=OffWhenAdmin
    Sets a ban entry to be disabled automatically while any admin is logged in
    npt ban change 192.168.47.3 Mode=Always bStealth=1 Expires= Delete= Next=#0
    Sets a ban entry to permanent stealth and moves it to the first slot in the ban table
    npt ban remove 127.0.0.1
    Remove all ban entries for the given IP address, including range ban entries where given IP address is included
    npt ban remove #-
    Remove all ban entries (it's always a good idea to make a backup of your `Unreal\System\Nephthys.ini` file every now and then ;-)
    npt web support http://zzora.altervista.org/ep2.zip
    Add a download url for Zora's episode 2 maps and mods to the web support table. (This command is not available in Nephthys Lite.)
    npt web list ZM2Citadel
    List all web table entries referring to the package 'ZM2Citadel'.
    npt web toggle zzora.altervista
    Disable/enable all web table entries using 'zzora.altervista'.
    npt web remove ep2.zip
    Remove all web table entries referring the archive 'ep2.zip' (it's always a good idea to make a backup of your `Unreal\System\NephthysWebDownload.ini` file every now and then ;-)
  - Commandlets top ⇑
    Nephthys offers new commandlets for the "ucc" command.
    To get an overview, create a command line window, change to your game's System folder (e.g. `C:\Unreal\System`) and enter:
    ucc help

    To get help for a specific command, enter e.g.:
    ucc help nptpackagecheck
    nptcompress File1 [File2 [File3 ...]]

    Description: | Compress an Unreal package for auto-downloading. A file with extension .uz will be created.
    Parameters: | Files | The wildcard or filenames to compress
    Example: | ucc nptcompress ..\Maps\mymap.unr

    nptdecompress CompressedFile

    Description: | Decompress a file compressed with ucc nptcompress.
    Parameters: | CompressedFile | The .uz file to decompress
    Example: | ucc nptdecompress mymap.unr.uz

    nptpackagecheck PackageFile

    Description: | Check a file as valid package. Packages may be misused to infect the target computer with a native virus. Nephthys checks packages automatically, e.g. if a client joins a server, and prevents from using infected packages. This commandlet may be used to check given packages explicitly.
    Parameters: | PackageFile | The wildcard or filenames of the package to check
    Example: | ucc nptpackagecheck *.u

  - Advice top ⇑
    - A server should be able to run without any administrator online keeping it alive. The server should block attacks automatically, should block actions which may trigger an internal bug and it should punish players with behaviour critical for the server. In this term a player logged in with admin password only to summon stuff to keep the other players happy etc. is more a "game moderator" than an administrator.
    - Without correct settings of server netspeed, max players and max spectators based on your server's upload bandwidth, you can't achieve any viable network traffic to supply a constant ping for your players, you even may note packet loss or instable player connections. Use the Netspeed Calculator for easy calculations of your server's settings.
    - You may put log entries together by using an IP address range (e.g. if you are sure it's always the same player). But once put together you can't get them divided automatically.
    - You may like to protect your `Unreal.ini` file by setting it to readonly, once you set up all settings as desired.
    - If you start the dedicated server from within a batch file, you can use the "INI=<filename>" and "LOG=<filename>" options to use different `Unreal.ini` and `Unreal.log` files for server and client (if you run both in same system folder) or just use different (system) folders for server and client.
  - How to handle attacks top ⇑
    - All attack detections can be configured in Nephthys. All configuration settings default to reasonable values for average servers. However, your server could diverge from the average in certain aspects. Thus, the attack detection could treat a normal player action as attack. In these cases a manual adaptation of the settings is necessary.
    - Single events of attack detections may be ignored if happened rarely.
    - If you can recognize a pattern in the attacks (examine your server logs) you may want to create a ban for that certain player.
    - A successfully connected player can cause more harm than an upcoming connection. If you know a certain player as unwanted on your server then create a matching ban entry.
    - For efficiency try to keep your ban table small.
    - If you need to ban a player with dynamic IP address you may want to block its entire range, even if catching other players. To minimize that range consult your log and build a range including the lowest and the highest IP address of the player (maybe rounded down to x.x.x.0 and up to x.x.x.255 resp.).
    - Be aware that some players have multiple dynamic IP address ranges with huge gaps between. You need a separate ban entry for each range.
    - To get more information about a questionable IP address try http://www.ripe.net/whois?form_type=advanced&alt_database=ALL (for european IP addresses) or http://www.arin.net/whois/ (for USA IP addresses; prefix the IP address with a plus sign to get extended info). Although there are more than 200 such IP address lookup services, you can start with either of the both: they will give you a link where to lookup the questionable IP address in detail. Those whois services will give you the name of the provider and a first IP address range to start with (but often you have to restrict the range for a ban by your log experience if you don't want to ban innocent players).
    - Setting bBanRQA=true is very restrictive and may accidentally ban a player due to a package plethora after a temporary network traffic accumulation. Therefore it is NOT recommended.
    - Setting bBanRUA=true is very restrictive and may accidentally ban a master server due to a package plethora after a temporary network traffic accumulation leading to broken uplinks (= server is not listed by that master server any longer). Therefore it is NOT recommended.
    - Recurring attack situations which unwantedly fill up the server log should be blocked by a firewall or router.
  - Release History top ⇑
    - New in Nephthys V1.5
      - Rune 101 support
      - Fixed a bug with detection of language other than 'int' for Deus Ex and Rune during installation
      - Installer detects installed engine version better now
    - New in Nephthys V1.4
      - Nephthys is now available for Unreal1, Deus Ex, Rune, Unreal Tournament
      - Challenge/response connection checking
      - Support for web server introduced
      - Quiet bans (no message, no log)
      - Logging of Unreal 227 client computer names and identities
      - Banning of Unreal 227 client computer names and identities
      - Packages are checked before loading, new commandlet
      - Self-deleting bans (after a configurable time)
      - Subnet attack detection and banning
      - Fixed a bug in uplinking to custom Deus Ex master servers
      - Fixed a bug with destroyed PlayerPawn in PostLogin
      - Fixed a bug with clients downloading very small packages very fast
      - Max. number of players per IP configurable
      - Configurable logging with causing IP to isolate attackers quickly
      - List overlapping ban entries
      - New options in connection status list
      - New RLM attack detection
      - First detections of attacks towards clients
      - HoldConnSeconds now is calculated automatically on map start
      - Fixed a bug at deletion of multiple web entries at once
      - Fixed a bug at deletion of multiple ban entries at once
      - Archives of type .uz are now supported
      - 7-Zip doesn't need to be installed with Windows Administrator privileges to be recognized
      - Checksum for uploads now calculated in smaller chunks to keep system responsible
      - npt status now gives more detailed informations
      - Smaller Nephthys.ini file
      - New uscript API functions
    - New in Nephthys V1.3
      - Nephthys is now available for Unreal1, Deus Ex
      - Web Download (support for clients and servers)
      - Installer
      - Support of Advanced Options in non-default language
      - RUF attack detection
      - RBO plethora detection
      - Log change of existing bans due to auto ban
      - Kick logs an optional comment now
    - New in Nephthys V1.2
      - New: IIA, RIIA and RIA attack detections
      - List ban entries by expiration date/time
      - Reply ban message of non-stealth bans to banned clients
      - Change existing IP/Name ban to activate it for auto bans
      - Handling of query attacks improved
      - Options bRejectEmptyClass, bRejectBlankName and bRejectEmptyPassword removed: crash is avoided now
      - Display uploading file size in better readable KBytes or MBytes instead of Bytes
      - Log upload summary if uploading connection is closed
      - Log upload summary of completed uploads
      - When upload warning is shown to non-admin players only the short file name is used, not the full path name as before
      - Don't spam server log with "recvfrom unknown error"
      - Don't crash with admin commands "npt log<blank>" or "npt ban<blank>"
      - Check DRJA configuration at startup
      - New Show... option value ESM_DontEvenLog to avoid spamming server log file in certain cases
      - Bug in kill double connections logic fixed
      - Bug in npt ban change <entry> next=#<num> fixed if new index is higher than old index
      - Private and APIPA IP address behaviour configurable now
      - Uplink query hack detection
      - Query upload package list introduced
      - Simplified upgrade installation
    - New in Nephthys V1.1
      - Fixed some false attack detections
      - Fixed partly deactivation when playing certain maps
      - Nephthys refuses new connections while Game.bGameEnded == true and bRejectAfterGameEnd == true
      - Nephthys now accepts connections with invalid login options name or class if bRejectBlankName == false resp. bRejectEmptyClass == false (both default)
      - Nephthys now rejects connections with invalid login option password if bRejectEmptyPassword == true (default)
      - Documentation extended
      - Configuration is checked during startup. If server exits immediately after startup see server's Unreal.log for details.
      - Name log now replaces names which only differ in case instead of storing both names.
      - Kill double connections logic is automatically disabled the first seconds after map change for better remote LAN player support (see option KillDoubleDelay for details).
      - ICMP messages of type 3 (destination unreachable) support fast close of dead clients
      - Kick() called from uscript now works without a port as well
      - The new NptServerUplink ServerActor (Unreal1 only) now supports custom made master servers
      - Ban rules aren't sorted at map change any longer
      - Bans can be set or changed to a specific slot number
      - The new uscript function GetBanInfo(slot) now allows browsing through existing ban rules
      - A possible crash during regular shutdown of the server is now avoided.
  - UScript interface top ⇑
    Nephthys provides an open uscript interface to be base for customized server mods. This chapter applies to server mod coders only.
    To compile your mod using Nephthys successfully, the uscript compiler needs to know the Nephthys.NephthysProxy class. Therefore:
    - If you use UnrealEd to create and compile your own class, then either load `Nephthys.u` from within the class browser or edit your `Unreal.ini` file and append to the end of the section `[Editor.EditorEngine]` the line `EditPackages=Nephthys`.
    - If you use `ucc make` to compile your own class then edit your `Unreal.ini` file and append to the end of the section `[Editor.EditorEngine]` the line `EditPackages=Nephthys`.
    The interface consists of the following parts:
    - Events
      Events are uscript functions called by the native code. To use them create a new class derived from Nephthys.NephthysProxy and write the functions using the following names/prototypes. An actor of this new class has to be spawned (e.g. place it into ServerActors (NOT ServerPackages!!!)). When the event happens, the function gets called. To get any event called bUscriptAPI=true needs to be configured (should either be given as installation instruction in your end user manual or make your mod set it during BeginPlay()!).
      event ConnectionRejected( string Addr, string Names );

      Description: | Called when connection is rejected before opening.
      Parameters: | Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space or `""` if not logged yet

      event ConnectionOpened( string Addr, string Names, out string MoreInfo );

      Description: | Called when connection is just opened, PreLogin() not yet passed. Data may be received or sent from now on.
      Parameters: | Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space or `""` if not logged yet
      Outputs: | MoreInfo | If the uscript mod can gain some more informations about this connection it may be stored here. These informations can be obtained later by calls to GetPlayerInfo(), GetConnectionInfo() or GetConnectionInfo2().

      event ConnectionDropped( string Addr, string Name, string Names );

      Description: | Called when connection is closed before PreLogin(), e.g. due to invalid join parameters or a recognized attack. Since the connection was closed now, no data may be sent or received any more.
      Parameters: | Addr | IP:Port of the current connection
      Name | The current name of the join attempt or `""` if not analysed yet
      Names | All known names for connection's IP address separated by space or `""` if not logged yet

      event PreLogin( string Addr, string RequestURL, string Names, out string Error );

      Description: | Called after a new player passed the game type's PreLogin().
      Parameters: | Addr | IP:Port of the current connection
      RequestURL | The complete URL of the join attempt
      Names | All known names for connection's IP address separated by space
      Outputs: | Error | To reject the join attempt at this place the uscript mod must set up an error message which gets logged. Although the connection gets dropped after that, the message isn't transmitted to the client. Use the game type's PreLogin() function to do so.

      event FileUpload( string Addr, string RequestURL, string Names, string FileName, int FileSize );

      Description: | Called when new connection started to load a file.
      Parameters: | Addr | IP:Port of the current connection
      RequestURL | The complete URL of the join attempt
      Names | All known names for connection's IP address separated by space
      FileName | The complete name of the file, including the device (drive letter) and all folder names.
      FileSize | The size of the file in bytes.

      event Login( string Addr, string RequestURL, string Names, out string Error );

      Description: | Called after new player passed the game type's Login().
      Parameters: | Addr | IP:Port of the current connection
      RequestURL | The complete URL of the join attempt
      Names | All known names for connection's IP address separated by space
      Outputs: | Error | To reject the join attempt at this place the uscript mod must set up an error message which gets logged. Although the connection gets dropped after that, the message isn't transmitted to the client. Use the game type's Login() function to do so.

      event ConnectionKicked( string Addr, string RequestURL, string Names );

      Description: | Called when an established connection is closed (kick).
      Parameters: | Addr | IP:Port of the current connection
      RequestURL | The complete URL of the join attempt
      Names | All known names for connection's IP address separated by space

      event Logout( string Addr, string Name, string Names );

      Description: | Called after a player passed the game type's Logout().
      Parameters: | Addr | IP:Port of the current connection
      Name | The name of the join attempt (might not be the name the player used at last)
      Names | All known names for connection's IP address separated by space

      event RjaAttackStarted( string Addr, string Names, int count, float TimeDelta );

      Description: | Called when a connection is considered to be RJA attacking.
      Parameters: | Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space
      count | Number of new connections resulting in attack detection
      TimeDelta | The time needed to open the connections.

      event RjaAttackStopped( string Addr, string Names, int count, float TimeDelta );

      Description: | Called when a RJA attack has stopped. This event can be called some time after the attack really stopped.
      Parameters: | Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space
      count | Number of new connections during attack
      TimeDelta | The duration of the attack in seconds.

      event DrjaAttackStarted( int count, float TimeDelta );

      Description: | Called when a connection is considered to be DRJA attacking.
      Parameters: | count | Number of new connections resulting in attack detection
      TimeDelta | The time needed to open the connections.

      event DrjaAttackStopped( int count, float TimeDelta );

      Description: | Called when a DRJA attack has stopped. This event can be called some time after the attack really stopped.
      Parameters: | count | Number of new connections during attack
      TimeDelta | The duration of the attack in seconds.

      event RiaAttackStarted( string Addr, string Names, int count, float TimeDelta );

      Description: | Called when a connection is considered to be RIA attacking.
      Parameters: | Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space
      count | Number of new connections resulting in attack detection
      TimeDelta | The time needed to open the connections.

      event RiaAttackStopped( string Addr, string Names, int count, float TimeDelta );

      Description: | Called when a RIA attack has stopped. This event can be called some time after the attack really stopped.
      Parameters: | Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space
      count | Number of new connections during attack
      TimeDelta | The duration of the attack in seconds.

      event IiaAttackDetected( string Addr, string Names );

      Description: | Called when a connection is considered to be IIA attacking.
      Parameters: | Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space

      event RufAttackStarted( string Addr, string Names, int count, float TimeDelta );

      Description: | Called when a connection is considered to be RUF attacking.
      Parameters: | Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space
      count | Number of new connections resulting in attack detection
      TimeDelta | The time needed to open the connections.

      event RufAttackStopped( string Addr, string Names, int count, float TimeDelta );

      Description: | Called when a RUF attack has stopped. This event can be called some time after the attack really stopped.
      Parameters: | Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space
      count | Number of new connections during attack
      TimeDelta | The duration of the attack in seconds.

      event RepetitiveConnectionAttackStarted( string attack, string Addr, string Names, int count, float TimeDelta );

      Description: | Called when a connection is considered to attack by repetition.
      Parameters: | attack | The name of the current attack: "RIA", "RJA", "RUF" or "RLM". Future Nephthys versions will call this event also for future attack detections.
      Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space
      count | Number of incidents resulting in attack detection
      TimeDelta | The time needed for the incidents.

      event RepetitiveConnectionAttackStopped( string attack, string Addr, string Names, int count, float TimeDelta );

      Description: | Called when a connection related repetition attack has stopped. This event can be called some time after the attack really stopped.
      Parameters: | attack | The name of the current attack: "RIA", "RJA", "RUF" or "RLM". Future Nephthys versions will call this event also for future attack detections.
      Addr | IP:Port of the current connection
      Names | All known names for connection's IP address separated by space
      count | Number of incidents during attack
      TimeDelta | The duration of the attack in seconds.

      event ExecuteAuxiliaryCommand( string cmd );

      Description: | Called when "npt aux <cmd>" is entered. It's just a shortcut to execute a command of your server side uscript actor.
      Parameters: | Cmd | The command string to execute.

    - Functions
      These native functions may be called by any custom uscript mod. Common usage is
      ret = class'NephthysProxy'.static.func(par)
      It may be called from any mod and any class, not necessarily derived from NephthysProxy. The value of bUscriptAPI doesn't matter.
      function string IpNameIsBanned( out string message, optional string ip, optional string name, optional bool bStealth, optional bool bCount );

      Description: | Determine whether an IP address and/or name is banned. To implement ban checking in the game type's PreLogin() or Login() a call of GetConnectionInfo() or GetConnectionInfo2() followed by a call of this function gains the information needed to return a (ban rule customized) message to the client.
      Outputs: | message | If a ban rule matches and it provides a message it's returned here, else `""`.
      Parameters: | ip | If given: determine whether this IP address is banned. At least IP address or name must be given. To match a name reservation ban IP address and name must be given.
      name | If given: determine whether this name is banned. At least IP address or name must be given. To match a name reservation ban IP address and name must be given.
      bStealth | If `bStealth!=false` (i.e. =`true` or omitted) only stealth ban rules are considered, all non-stealth ban rules aren't applied
      bCount | Whether to count the ban appliance (depending on bStealth)
      Returns: | The description of the first matched ban rule or `""` if none matched.

      function string BanIpName( optional string ip, optional string name, optional string comment, optional string AppendIfNot, optional bool bQuiet );

      Description: | Insert a new stealth ban rule, valid always and forever, or set an existing ban rule to always valid and append the comment.
      Parameters: | ip | If given: ban this IP address. Either ip or name must be given.
      name | If given: ban this name. Either ip or name must be given.
      comment | Additional comment for this rule (e.g. reason).
      AppendIfNot | If an existing ban rule matches the parameters and it doesn't include any of the (space separated) words given here, the new comment is appended to the old comment (with comma and space as separator). Otherwise the old comment is replaced by the new comment. Note that existing ban rules aren't set to stealth.
      bQuiet | Whether to create a quiet ban (which isn't logged or shown when applied).
      Returns: | A message what has been done.

      function string GetBanInfo( int slot );

      Description: | Read the ban information of a given ban number as a printed string.
      Parameters: | slot | The ban number to examine.
      Returns: | The description of the matched ban rule or `""` if none matched.

      function bool GetPlayerInfo( PlayerPawn PP, out string Addr, out string State, out string Names, out string MoreInfo );

      Description: | Gets informations about a given player or the event causing connection.
      Parameters: | PP | The PlayerPawn to obtain the informations for. Called from within the game type's PreLogin(), Login() and PostLogin() functions this parameter may be set to `none` to obtain informations about the connection causing the event call of PreLogin(), Login() resp. PostLogin(). Called from any other context this parameter has to refer to an existing PlayerPawn, else this function will fail.
      Outputs: | Addr | Current IP:Port of the player.
      State | State of the connection.
      Names | All known names for connection's IP address separated by space
      MoreInfo | More informations as given by event ConnectionOpened()
      Returns: | Whether it worked out good (`true`) or bad (`false`, e.g. no connection for PlayerPawn).

      function bool Kick( optional PlayerPawn PP, optional string Addr, optional string Comment );

      Description: | Kicks by a given PlayerPawn, IP:Port or IP. The traffic is stopped immediately, the connection is closed as soon as possible.
      Parameters: | PP | If given: the PlayerPawn to kick. Either PP or Addr must be given.
      Addr | If given: IP:Port or IP to kick. If only IP is given all connections matching this IP address are kicked.
      Comment | If given: A comment to log together with the kick (as reminder for later log inspections).
      Returns: | Whether it worked out good (`true`) or bad (`false`, e.g. no connection for PlayerPawn or IP address currently not online).

      function string LogIpName( string ip, string name );

      Description: | Log a new name for a given IP. E.g. this may be called in case of name changes.
      Parameters: | ip | The IP address to log.
      name | The name to log.
      Returns: | A message what has been done.
      Remark: | Better use LogPlayerName(). It's more exact with players with same IP address.

      function string LogPlayerName( PlayerPawn PP, string name );

      Description: | Log a new name for a given player. E.g. this may be called in case of name changes.
      Parameters: | PP | The PlayerPawn to log the name for. Called from within the game type's PreLogin(), Login() and PostLogin() functions this parameter may be set to `none` to log the name of the connection causing the event call of PreLogin(), Login() resp. PostLogin(). Called from any other context this parameter has to refer to an existing PlayerPawn, else this function will fail.
      name | The name to log.
      Returns: | A message what has been done or `""` if failed.

      function ExecuteCommand( string cmd );

      Description: | Executes a command as if given by npt <command>.
      Parameters: | cmd | The command string to execute.

      function bool GetConnectionInfo( string Addr, out PlayerPawn PP, out string State, out string Names, out string MoreInfo, out string UploadFilename, out int UploadTransfered, out int UploadTotalSize );

      Description: | Gets informations about a given connection.
      Parameters: | Addr | IP:Port of the connection to examine.
      Outputs: | PP | PlayerPawn using this connection or `none` if not connected yet / anymore.
      State | State of the connection.
      Names | All known names for the connection separated by space
      MoreInfo | More informations as given by event ConnectionOpened()
      UploadFilename | The complete name of the file currently uploading, including the device (drive letter) and all folder names or `""` if connection isn't uploading.
      UploadTransfered | Number of bytes already uploaded or 0 if connection isn't uploading.
      UploadTotalSize | The size of the file in bytes or 0 if connection isn't uploading.
      Returns: | Whether it worked out good (`true`) or bad (`false`, e.g. no connection for Addr).
      See: | GetConnectionInfo2() provides more informations.

      function bool GetConnectionInfo2( string Addr, out PlayerPawn PP, out string State, out string Names, out string MoreInfo, out string UploadFilename, out int UploadTransfered, out int UploadTotalSize, out int Computer, out int Identity );

      Description: | Gets informations about a given connection.
      Parameters: | Addr | IP:Port of the connection to examine.
      Outputs: | PP | PlayerPawn using this connection or `none` if not connected yet / anymore.
      State | State of the connection.
      Names | All known names for the connection separated by space
      MoreInfo | More informations as given by event ConnectionOpened()
      UploadFilename | The complete name of the file currently uploading, including the device (drive letter) and all folder names or `""` if connection isn't uploading.
      UploadTransfered | Number of bytes already uploaded or 0 if connection isn't uploading.
      UploadTotalSize | The size of the file in bytes or 0 if connection isn't uploading.
      Computer | The 227 client computer information or 0 for older clients.
      Identity | The 227 client Identity information or 0 for older clients.
      Returns: | Whether it worked out good (`true`) or bad (`false`, e.g. no connection for Addr).

  - Construction
    - Editor(s) used: UnrealEd fix 4, VC++ 6.0 SP5, fred, EditPlus
    - Base: Unreal Public Headers 224v and Gold, UT Public Headers v432, Deus Ex Public Headers 1100, Rune Public Headers 101, Rune Public Headers 107, Kerberos
  - Credits
    - }TCP{Wolf
    - Bolke_DE_Beer
    - Zombie
    - Sixpack_Shambler
    - SA|BarendB
    - Hyper.nl
    - Zisu
    - Turboman
    - {hLk}Havok
    - Hawk
    - All who gave us feedback
  - Disclaimer top ⇑
    - The authors DISCLAIM ALL DAMAGE to ANY of your property (whether it is your hardware, software, storage medium, or anything else computer, or non-computer related) that may be caused by the use, misuse, or distribution of this software, even if the authors have been advised of the possibility of such loss.
    - If you lose anything (including, but not limited to, time or money) as a result of the use, misuse, or distributing of this program, YOU ARE FULLY RESPONSIBLE for ALL costs, and you agree to hold the authors COMPLETELY harmless for ALL costs in ANY shape or form.
    - In particular take care when using the web download feature.
  - Copyright / Permissions top ⇑
    - This mod is copyrighted 2004-2009 by Winged Unicorn and Zora (original code belongs to Epic).
    - Authors may use this mod as a base to build their own mods (e.g. creating an UnrealScript extension).
    - This mod is absolutely freeware. You MAY distribute this modification through any electronic network (Internet, FIDO, local BBS etc.), on condition that you include this file and leave the archive intact.
    - You are NOT allowed to gain any money for this mod. You are NOT allowed to commercially exploit this mod, i.e. put it on a CD or any other electronic medium that is sold for money, without explicit permission of Winged Unicorn or Zora!
    - You are NOT allowed to decompile the DLLs nor to hack into Nephthys in any kind.
    - Don't give this mod to people you don't trust!
  - Trademarks
    - Unreal © 1998 Epic Megagames, Inc. All Rights Reserved. Distributed by GT Interactive Software, Inc. under license. Unreal and the Unreal logo are registered trademarks of Epic Megagames, Inc. All other trademarks and trade names are properties of their respective owners.

End of Document