Just discovered that since 6.6 (or maybe 6.6a) the IPlog is filled with a lot of "|Server Query|". It would be nice if we could get the clean IPlog back.

It started happening to me since I updated to Plus 6.4 in November on PN servers. I am guessing that Zeal Duels was still on 6.1 for a while, thus why he noticed it just recently.

Shaker is right. It seems like it started with 6.4.

Okay! That was quite a bit of research, but I seem to have figured out what happened in 6.4, though I'm speculating with limited information in some places:

At some point prior to JJ2+ v4.0, which is the earliest that we have records of, BlurredD added some code to detect server queries, e.g. from GIP scripts. The code was intended to look at TCP packet 0x0E and run if either of the following two conditions was true:

• The numberOfPlayers byte equaled 0, OR
• playerName began with the section character followed by the pipe character (|)

If either of those conditions was true, the code was meant to write the Server Query line to iplog001.txt (or whatever), send the client any useful information, and then kick the client.

I can see that both DJazz's SGIP script and jj2multiplayer's fork use names beginning in section-pipe, though neither of them sets numberOfPlayers to 0, so JJ2+ has to rely on just the player name. I'm assuming without evidence this has always been the case and the packet sent by SGIP has never changed.

(The SGIP packet is, incidentally, incorrectly formatted... it uses the packet format from JJ2+ v1.3 or earlier, but claims to be JJ2+ version 3.0. However, JJ2+'s code for reading packet 0x0E was also never updated for version 1.4, so JJ2+ was looking at the right byte all along.)

Crucially, at some point somebody accidentally used the wrong character encoding to save the JJ2+ source file that reads packet 0x0E and checks names for section-pipe. This was publicly visible in that, for a while, when players joined LRS servers and were automatically set to zero lives, they saw a green A (with a diacritic) at the start the following two lines, which was an artifact of using the wrong character encoding for that source file:

AYou joined late so you are out of the game.
APlease wait patiently for the next game to start.

This was later fixed by saving the file with the correct character encoding. Probably this happened in 6.4.

While the file's character encoding was wrong, instead of comparing player names to section-pipe, they were instead compared to A-section-pipe. That meant that the server query line stopped appearing for a while, although for many years before that, it had been reliably appearing in iplog files as intended.

In summary, 6.4 accidentally fixed an unknown bug that was preventing the server query line from appearing.

According to BlurredD in 2014,

Server queries are logged so that it's easier to find potential abuse (picture someone sending hundreds of queries a second)

However, according to stijn in 2023,

SGIP now uses the query packet to query servers so one of the underlying reasons this became a problem is no longer there (though there may be other GIP lists out there that still emulate joining the server).

So that's puzzling! Did something change between 2023 and now that caused SGIP scripts to stop using the query packet and go back to using packet 0x0E? Or was stijn talking about a different SGIP than the djazz.se and jj2multiplayer.com pages?

I'm limited here without knowing how SGIP works, but I'm wondering if maybe SGIP is sending the query packet and packet 0x0E, but not actually using the response from 0x0E? Because if I'm reading the JJ2+ code right, trying to join a v4.0 (or above) server and pretending your client is v3.0 is not actually going to give you any useful information, assuming the server has /latestversiononly enabled, unless the server treats you as a server query.

I also want to post Seren's idea from the last time we talked about the Server Query line internally (presumably from before it accidentally stopped working):

I think the primary purpose of IP logs is to provide IP addresses to ban or block from the firewall in case of malicious behavior. Under that assumption, it seems unwise to me to let any IP or type of request be left out from logging completely. I think a safer solution would be to group consecutive log messages that only differ by timestamp, i.e. instead of

[02:01:59] ID: 2 IP Address: 192.168.1.1 Name: Seren2
[02:02:34] ID: 2 IP Address: 192.168.1.1 Name: Seren2
[02:02:46] ID: 2 IP Address: 192.168.1.1 Name: Seren2
[02:03:23] ID: 2 IP Address: 192.168.1.1 Name: Seren2
[02:03:38] ID: 2 IP Address: 192.168.1.1 Name: Seren2

log

[02:01:59] ID: 2 IP Address: 192.168.1.1 Name: Seren2
+ 4 more times over a period of 00:01:39

Originally Posted by Violet CLM

I also want to post Seren's idea from the last time we talked about the Server Query line internally (presumably from before it accidentally stopped working):

That might be a good idea.

I've implemented Seren's idea in 6.6c.

Thanks!

To be honest, I am not sure if this is any cleaner. I mean, it does reduce the lines, but the fact that Server Query joins from multiple IP addresses makes it spammy still.

[01:06:51] ID: ?  IP Address: 192.168.1.1     Name: |Server Query|
[01:07:20] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 1 more over a period of 0 minutes 47 seconds
[01:08:07] ID: 5  IP Address: xx.xx.xx.xx   Name: SuperJustin
[01:08:47] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:09:13] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 3 more over a period of 4 minutes 34 seconds
[01:13:47] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:14:12] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 6 more over a period of 4 minutes 35 seconds
[01:18:47] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:19:13] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 4 more over a period of 4 minutes 35 seconds
[01:23:48] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:24:14] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 4 more over a period of 4 minutes 34 seconds
[01:28:48] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:29:03] ID: ?  IP Address: 192.168.1.1     Name: |Server Query|
[01:29:13] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 3 more over a period of 2 minutes 48 seconds
[01:32:01] ID: ?  IP Address: 192.168.1.1     Name: |Server Query|
[01:33:49] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:34:15] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 4 minutes 34 seconds
[01:38:49] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:39:14] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 4 minutes 36 seconds
[01:43:50] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:44:14] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 4 minutes 36 seconds
[01:48:50] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:49:15] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 4 minutes 35 seconds
[01:53:50] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:54:16] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 4 minutes 34 seconds
[01:58:50] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[01:59:16] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 1 more over a period of 1 minutes 46 seconds
[02:01:02] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:01:03] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 1 more over a period of 2 minutes 48 seconds
[02:03:51] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:04:18] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 3 more over a period of 4 minutes 33 seconds
[02:08:51] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:09:17] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 4 minutes 34 seconds
[02:13:51] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:15:54] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 57 seconds
[02:18:51] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:20:25] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 3 minutes 26 seconds
[02:23:51] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:25:54] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 3 more over a period of 2 minutes 58 seconds
[02:28:52] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:30:55] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 58 seconds
[02:33:53] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:35:55] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 3 more over a period of 2 minutes 58 seconds
[02:38:53] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:40:28] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 31 seconds
[02:42:59] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:43:05] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
[02:43:53] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:45:25] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 1 more over a period of 1 minutes 34 seconds
[02:46:59] ID: 4  IP Address: xx.xx.xx.xx    Name: LarK[si]
[02:47:03] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 1 more over a period of 1 minutes 51 seconds
[02:48:54] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:50:25] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 3 more over a period of 3 minutes 29 seconds
[02:53:54] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[02:55:23] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 3 more over a period of 3 minutes 31 seconds
[02:58:54] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:00:24] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 3 more over a period of 3 minutes 30 seconds
[03:03:54] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:05:26] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 3 more over a period of 3 minutes 28 seconds
[03:08:54] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:10:59] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 56 seconds
[03:13:55] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:15:59] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 57 seconds
[03:18:56] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:21:00] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 57 seconds
[03:23:57] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:25:59] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 58 seconds
[03:28:57] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:31:01] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 56 seconds
[03:33:57] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:35:21] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 24 seconds
[03:37:45] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:38:09] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
[03:38:58] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:41:01] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 58 seconds
[03:43:59] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:46:02] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 57 seconds
[03:48:59] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
[03:51:02] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 58 seconds
[03:54:00] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
 + 2 more over a period of 2 minutes 2 seconds
[03:56:02] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 2 more over a period of 2 minutes 19 seconds
[03:58:21] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|
 + 2 more over a period of 2 minutes 43 seconds
[04:01:04] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 27 more over a period of 44 minutes 4 seconds
[04:45:08] ID: 3  IP Address: xx.xx.xx.xx   Name: SuperJustin
[04:47:22] ID: ?  IP Address: 193.203.169.120 Name: |Server Query|
 + 4 more over a period of 7 minutes 35 seconds
[04:54:57] ID: ?  IP Address: 83.253.156.40   Name: |Server Query|

Presumably these are queries from different tools? jj2multiplayer vs djazz.se, perhaps?

Yes. There are several websites hosting sgip.