I'm just starting to read up on hacking in the Shadowrun universe, but I didn't see anything about corps or people being able to tell you're looking for their hidden network. Is it possible to detect these scans, or is it just seen as general network traffic?

  • 1
    \$\begingroup\$ I assumed you mean "Hidden Node", as there is no mention of "hidden network" in the rules. \$\endgroup\$
    – Trajan
    Feb 14, 2014 at 9:59
  • \$\begingroup\$ @Trajan Sorry, device in hidden mode is what I meant, so yes a hidden node. Thanks for the correction! \$\endgroup\$
    – Josh
    Feb 14, 2014 at 17:56

2 Answers 2


Simple Sniffing is Undetectable

IRL as in the rules, simple network traffic capture is undetectable. Whether that traffic tells you anything about the network is another matter altogether, but it probably won't give you a network map, especially if behind any sort of edge device (IRL the edge device might NAT everything behind it).

Assuming the node is the direct target, it would have to be actively dropping packets on the network to be passively detected and responding to "pings" to be actively detected.

Success/Failure Plan

Working from Trajan's answer, here's how I might adjudicate detection of a scan, which IRL is akin to a network probe: drive the player experience without breaking immersion (or the fourth wall) by having a success or failure plan.

In attempting to detect the node, the node owner—presumably the runner's target—is made aware of the scan/probe only in failure of the hacking test. What the owner is aware of might be modeled on how badly the test fails.

Simple failure might mean that the node is not detected. Higher "degrees" of failure might inform the owner more about the attempt, gradually going from "Aha! someone is scanning my network" to "This rank amateur is scanning my node and he's doing it from the coffee shop at 3rd and Elm" in the case of a catastrophic failure.

In this, you abstractly model real life without trying to make it just like real life.

Abstraction by test success/failure is a better plan. Having a plan ready so you don't have to say "Oh, the ICE near the node has X ability and rolls opposed to your Y ability and succeeds by Z much". A plan allows you to say something like "You see the ICE drop onto the grid and a bright line sweeps across you. The sense that you've been scanned overwhelms you as bright bursts of data leave the ICE like tracers from a Panther assault cannon to its owner. A feeling of being naked and exposed crawls across your flesh back at the apartment/coffee shop/rent-a-room."

Real Life Network Probing

Today's network engineering toolkits pretty much apply an acceptable threshold in identifying attack and threats in network scanning. Oneoff pings are so ubiquitous they are all but ignored or "dropped" in the "bit bucket" by edge devices (or by configuration at the target firewall). "Dropping ICMP packets" is how devices are typically hidden on a network. If you can't "ping it" you can't know anything is at the address goes the logic. DNS tends to betray this by mapping a name to an address. But hosts can be distributed by DNS multiplexing and … the rabbit hole just leads deeper.

DDoS detection is sophisticated monitoring of volume traffic, often looking across network boundaries. Scanning is often difficult to detect at the target node, but easier across edge devices. Any sophisticated network, especially one of a mega-corps, will likely have honeypots and ICE at the edge of possible targets to assist in detection.

As GM you probably don't want to model real life as it can be quite deep and complicated.

  • \$\begingroup\$ First, thank you! Second, I'm so glad this answer was helpful. In 1990 I was a tournament Shadowrun GM at Atlanta Fantasy Fair, so the answer was from a place that, in the last 23 years, was sincere and tempered in professional experience as a Web Application Architect. While I have only played 1E and 2E with any passion and sold my SR 1E/2E collection 13 years ago—ah, the pit traps of <impressive-clergyman>Ma-wage</impressive-clergyman>—I still remain a fan of the setting and the game. \$\endgroup\$
    – javafueled
    Feb 16, 2014 at 1:00

There is no strict answer to this question in the rule but I'd say maybe.

  • The rule :

The description of the matrix action Capture Wireless Signal (Sniffer) explicitely tells us (SR4A p.229) :

There is no way for other parties to detect your capture

While the Detect Hidden Mode doesn't.

  • My interpretation :

disclaimer: while I may have some basic knowledge in computer science, I have almost no experience in networking, and this is nothing but personal opinion. Also, be aware that trying to enforce technical realism in SR4 may not be a good idea

Assuming the hidden node isn't broadcasting anything (slave nodes, watching a movie on netflix, etc.), there is no way of being aware that there is a receiver. So I guess the scan program detects hidden nodes by trying to send data and see if anything respond. That would make scanning detection possible. If the hidden node is emitting receiving traffic, then spotting such request would be difficult, and scanning would be less efficient than sniffing to know if there is someone in the area. Trying to hack the hidden node would still require a Scan action.

  • 1
    \$\begingroup\$ A brief discussion on Information Security's SE chat seems to confirm this. \$\endgroup\$
    – Trajan
    Feb 14, 2014 at 10:01
  • \$\begingroup\$ I'm a 100% sure that no, it should not be possible to detect whether someone is looking for a hidden network, but I can't find any good argument to back it up, that's extremely frustrating. \$\endgroup\$ Feb 14, 2014 at 16:46
  • \$\begingroup\$ As @Trajan notes, applying real world network engineering can "break the fourth wall" \$\endgroup\$
    – javafueled
    Feb 14, 2014 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .