Lol, good thing you posted this cause this game is way too hackable
http://dl.dropbox.com/u/6281166/client%202011-04-17%2022-32-02-96.png
http://dl.dropbox.com/u/6281166/client%202011-04-17%2022-35-02-91.png
http://dl.dropbox.com/u/6281166/client%202011-04-17%2022-53-47-61.png

http://www.youtube.com/watch?v=gze_L6O7pm4

Is there a way to temporarily block people - eg kick but not ban? I'd like to be able to boot people to make way for an admin or preferred player.

I end up being able to capture packets from client "23", yet it always kicks "26" when I add the IP to firewall.
What's going on?

Ack, can't edit the original anymore. I made a booboo in the iptables rule (depending on your iptables setup).

You need the block before the 'accept packets on 32887' rule so the -A append doesn't work, you need an -I insert (at index 1) so it comes before the accept rule in the chain:

iptables -I INPUT 1 -s CLIENT_IP -p udp --destination-port 32887 -j DROP

You can use a memory editor to monitor chat messages and usernames. Maybe find out how to communicate with clients through wireshark and it wouldn't be too bad.

Gotta get a regular client spot really (unless you use tshark to monitor what's going through chat or something).

And how might I join my own server to figure who cheats?

Thought some other people might appreciate this, this is assuming you're using iptables as your firewall, you'll also need tshark (command link Wireshark client).

While connected to the server view the scoreboard (TAB). To the left of each user name is their connection ID, you need this to identify the user.

Now run:

tshark -f "dst net SERVER_IP and udp dst port 32887 and udp[9:1]=USER_ID" -c 1

replace SERVER_IP with your server IP and USER_ID with the connection ID taken from the scoreboard.

You should see the details of a single packet dumped to the console, this shows the user's IP address (make sure you get the right one, it also shows the server IP address!).

Now do:

iptables -A INPUT -s CLIENT_IP -p udp --destination-port 32887 -j DROP<br />

Replace CLIENT_IP with the IP you looked up via tshark.

Hope that helps some people (until 0.26 comes out anyway...).