Over the weekend my Technomancer hit a very basic point of disagreement with my GM: physical devices being hidden entirely inside hosts. My Crack Sprite failed to get onto the host when I sent it to set up Suppression before the rest of us tried to jump on, and thus alerted the host (and the spider). I decided to run the rest of the mission from outside the host, directly targeting the physical objects that were wireless-enabled rather than risking the IC and angry spider on his home turf (I was kind of hoping to draw him out here with me so I could fight him without the IC backing him up), but the GM ruled that none of the objects could be targeted - by Matrix or Resonance actions - until I hopped onto the host.

This completely doesn't match my expectations of how the Matrix works, but I couldn't find a reference that specifically said it works the way I think it does, either. The closest I could find was that you can get marks on a host in order to enter it through the direct-connection hack on an object slaved to the host, which seems impossible by his ruling, but that's kind of weak.

Please note this isn't a Rule Zero situation where the GM has looked at how the Matrix works and decided to change it for his game. This is his interpretation of RAW and RAI, not a house rule. We both admit we're rather new to this, and the Matrix chapter of the book is especially poorly written. Is there an expectation as to how this is supposed to work?

Clarification: I am logged onto the Matrix, but not into a specific host, just out on the grids. My GM's ruling is that physical devices can be not just slaved to (and thus benefit from the Firewall rating of), but also have their icons drawn into the host to make them completely immune to hacking unless the hacker has already hacked into that host.

  • \$\begingroup\$ I did find something in the Matrix that seems to side with my viewpoint: device icons (that aren't personas) always overlay the real-world location that the device is; that is, where it is in the Matrix is also where it is in the real world. As a host is entirely virtual and has no meat-space equivalency, it stands to reason that devices cannot exist there. \$\endgroup\$ Aug 16, 2014 at 10:24

5 Answers 5


(Please see my updated answer)

TL;DR: As a GM, I would call that the Technomancer is right, and the GM should rethink hacking devices slaved to hosts. If a device is wireless, you can hack it like normal, using the host's rating as a firewall (unless you have DNI, and then you just attack it directly). Just like a PAN, devices are still visible to the Matrix even when slaved. Icons in the host are assumed (by me) to be virtual. Look at the Dante's Inferno example if you want to know why I assume so.

I've been searching for prime book examples, but it's hard to find it spelled out. So, below is the research I did, followed by my conclusion.

First, on 216:

wide area network: A set of devices slaved to a host.

This sets what we already know: You can slave a device to a host. I wanna make sure we define what a host is, so on page 219 we find:

Hosts are virtual places you can go in the Matrix. They have no physical location, being made up of the stuff of the Matrix itself.

Simple enough, right? Hosts are servers on the cloud.

I found this bit at the top of 221 interesting:

High-class hosts advertise "No public-grid connections allowed" to show how their clientele are elite.

Alright, so we've established that hosts can block people who are connecting from certain grids.

Page 224 has an example of attacking a host, but using a DNI and connecting directly to an offending unit. But they do say this:

He ignores the bank's firewalls surrounding the lock, attacking the lock through his direct link.

This tells me he has the option of hacking the lock using the Matrix, but he'd have to go against the firewall. Instead, he's using a DNI, so no firewall. And he's not even on the host yet. Key piece of data there, but let's read on to see what else we can find.

I found a bunch more relating to the effects of attacking hosts, but that's not needed. Hmm, what else.

Ah, on page 233:

There are risks to slaving devices. Because of the tight connections between the devices, if you get a mark on a slave you also get a mark on the master. This happens even if the slave was marked through a direct connection, so be careful about who you give your slaved devices to. This doesn’t work both ways; if you fail a Sleaze action against a slaved device, only the device’s owner gets the mark on you, not the master too.

There are also wide area networks, or WANs, with multiple devices slaved to a host. A host can have a practically unlimited number of devices slaved to it, but because of the direct connection hack you rarely see more devices than can be protected physically. If you are in a host that has a WAN, you are considered directly connected to all devices in the WAN.

So, we've established that devices can be slaved to a host via a WAN. Alright. And it looks like you CAN attack a device without being on the WAN, as per the example, but you'd have to go through the host's firewall. Alright. And if you get a hit, you get a hit on the host, of course. Let's keep going just in case, but right now it's looking like the GM might need to rethink the rules. But, let's read on, I know there's more:

Page 236 gives us:

If you can show a device or host or whatever that you have the right mark, you can go where you want to go.

And later:

There are three ways to get a mark on an icon. The first is the legitimate way: the icon invites you to add a mark. For example, when you pay the cover to get into the host of Dante's Inferno, the host sends you an invite to mark it so you can enter and join the party. The other two ways are by hacking, both Matrix actions: Brute Force (the loud way) or Hack on the Fly (the sneaky way).

So accessing the host requires that you have a mark. But the previous example implies, to me, that you didn't have to have access to the host to hack the maglock. So far it all seems in line.

Page 239 has the Enter/Exit Host action, which requires a mark on the host. So, you'd have to be able to hack the host before you can get inside. And since slaved devices are hackable points, that tells me, still, you don't have to be on the host to hack the devices.

Page 246 says:

Each host is on a specific grid. Like the rest of the Matrix, a host can be accessed from any grid.

So, there's that. I guess hosts can ban people from a certain grid, but you can still hack into it from the public grid. You just won't be invited. But wait! I found a section about icons being drawn into the host!

Page 246 also said:

The virtual space inside a host is separate from the outside grid. When you’re outside of a host, you can’t interact directly with icons inside it, although you can still send messages, make commcalls, and that sort of thing. Once you’re inside, you can see and interact with icons inside the host, but not outside (with the same caveat for messages, calls, etc.).

The thing I want to point out is that there's no mentioning of hosts being able to put their slaved device icons internal, because these are physical devices and they're just being slaved. So, if the device is wireless, then you can hack it. If it isn't, you need a DNI or access to the host.

  • 1
    \$\begingroup\$ So I don't have 5th, but in 4 signal was a big determining factor in whether or not you could hack a given device (due to necessatating proximity). Something hard-wired into a host in this case without a wireless signal would need to accessed through the host, or otherwise ripping out its innards to get at it (or a technomancer with skin contact networking, etc). Something to keep in mind (but I might be misreading the question). \$\endgroup\$
    – Cthos
    Aug 15, 2014 at 18:46
  • \$\begingroup\$ There's Noise in the 5th. The 5th also makes examples and details how a direct connection to a device means you don't have to worry about the host. It also mentions that most places only slave as many devices as can be guarded, implying that slaving a security camera, for example, likely wouldn't happen because it makes it so easy to hack the host, wireless or nay. Are we talking about the same thing? \$\endgroup\$
    – Codeacula
    Aug 15, 2014 at 20:24
  • 1
    \$\begingroup\$ Sort of, I think the crux of what I was getting at is "if it's signal is too low for you to pick up on and if you don't physically access it, you have to go through the host." Re-reading the OP though, it sounds like he had physical access to the devices. \$\endgroup\$
    – Cthos
    Aug 15, 2014 at 21:33
  • 1
    \$\begingroup\$ If he's in the building staring at the camera, the noise level wouldn't affect it too much. While you're right, I don't think noise is the question here, so much as "There's a camera right there, but I can't hack it because GM says there's no icons." The GM could apply modifiers for noise to make it harder (which would be a good idea, given the scenario) \$\endgroup\$
    – Codeacula
    Aug 18, 2014 at 16:30

After pondering this question for a bit, I decided against my previous answer

I found the following on 355, since I finally decided to read the GM section of the matrix thoroughly (even though I've been GMing 5e for a while now because I'm a terrible GM):

Creating a Host is akin to constructing a building and putting important things inside. None of the devices can be accessed without first gaining access (via a mark) to the Host itself.

This seems to imply that, just like putting a ring inside the building, the walls of the host would hide the location. And just like breaking into a building, breaking into a host would allow you to see it. But we also have...

The Host then becomes the Master for all of the devices within it, thus providing the same protection as a WAN.

I can't entirely say that I would allow you to see the icons in the Matrix without having hacked the host first, after reading this. It is still a bit questionable of a call, but having found that I would have to agree with your GM :(.



Physical devices are not hidden inside a host.

Slaved devices are still on the grid, outside of a host. There is no evidence that suggests that slaving a device puts it inside the host.

Those same devices are visible from inside of the host and any access to them from inside the host is treated as a direct connection.

SR5 p.233: If you are in a host that has a WAN, you are considered directly connected to all devices in the WAN.

Physical devices that are slaved to a host can be shielded through various means (noise, Faraday cage, wireless off) so they are not visible from distance and they could run silent.

EDIT: Clarification from Shadowrun forums:

Agree that the book isn't very clear on this. It has has been clarified that both the slave and the master in a Personal Area Network need to have the same owner.

If you slave your device to a host (being part of a WAN) only you (the owner of the device, not the host) get a mark on a hacker that fail a sleaze action against your device.

  • \$\begingroup\$ Doesn't your quote of p.233 imply they're in the host, though? The OP wasn't in the host at the time. \$\endgroup\$
    – Codeacula
    Jul 8, 2015 at 22:04
  • \$\begingroup\$ @Codeacula the first paragraph covers OP situation. He will see the device on the grid. The quote is support for the second paragraph. \$\endgroup\$
    – Korusef
    Jul 8, 2015 at 22:11
  • \$\begingroup\$ I guess in this case since RAW is murky it would be RAI, which leaves us where it is now, eh? \$\endgroup\$
    – Codeacula
    Jul 8, 2015 at 22:12

If a physical device is wireless-enabled, it has an Icon. Icons can be seen wirelessly with a Matrix Perception check (Computer + Intuition [Data Processing]).

Device icons are never 'placed inside' a Host. Devices can be 'slaved' to a Host, however ('PANs and WANs', pp233), which means they use the Firewall and Device Rating of the Host instead of their own if hacked wirelessly. A Direct Connection (plugging into the device, or using a data or cable tap) bypasses that, meaning a Slaved device will still use it's own device rating and firewall (usually quite low compared to a Host's), and a hacker will still get the free Mark on the Master device when they hack in (this is how you 'enter' a high-rating Host - not by attacking it from outside, but by physically connecting to a slaved device).

Persona icons can enter a Host, for example, a Persona running on a Deck would NOT have the Deck's device icon present and visible in the area of the matrix corresponding to the area of the real world the deck was in, if the Persona was in a Host, due to the poor wording of pp 234-35, 'Devices and Personas'.

The Icons inside a host are typically IC icons, persona icons, program icons, and data icons. There's no indication (and it in fact implies the opposite) that device icons ever actually 'enter' a Host, and therefore are hidden from view.

Nothing in the PANs and WANs section even slightly implies that slaving a device to a Host causes it to 'enter' the Host.


I depends how far in physical world you are from the device.

SR5, 235 (in "Matrix Perception"):

You can automatically spot the icons of devices that are not running silent within 100 meters of your physical location. No matter where you are in the Matrix, your commlink or deck (or your living persona) only has its own antenna for wireless signals, so this distance is measured from your physical location no matter where you are in the Matrix. Beyond this distance, you need to make a Matrix Perception Test (p. 241) to find a specific icon.

RAW are contradictory about this so it is the GM's call. Personally I like to let the players spot icons slaved to the host if they are within 100m from the devices in meatspace. It doesn't negate the value of slaving devices to a host (they still use host's rating when defending against spotting) and gives incentive to get out of the van and play with the rest of the party.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .