When a character has hacked into a system and the system is running an Analyze program (which is like always) how often does the system roll against your stealth to determine if you've been spotted? This is a little confusing in the books as it says the system is always randomly scanning users to determine if they're legitimate but never really says how often this random scan takes place. Also if the system has a spider does the spider also get a perception test to "see" you or is that what the analyze program on the system is doing for him?

Well, I imagine that ALL servers/webpages/nodes would make an analyze check to see how many users are online but they will hardly look for hidden people.

More secure sites might have a better program to fidn hidden people though and Boot/Flag the person as they might not be allowed to be hidden (very much like a hidden commlink).

Although it would be hell to play, a node could use analyze every IP.

I'm not sure that the system can check you again. I think that once you've gone past the firewall, it's the IC's job to check for intruders.

As for the "analyze every IP" idea, please consider how many glitches per user per hours you'll statistically get with such a setup and you'll understand why I don't think it's a good idea.

Unwired makes mention of Analyze constantly verifying every icon in some systems.

Basically, figure the Analyzing ICE gets, what 3 init passes per turn. So it can scan 3 icons per turn. If you configure your ICE to only scan Personas, you can expect a couple of Turns before it's done scanning everyone and starts over.

So I play it that Analyzing ICE scans you every few turns, based on volume in the system. I vaguely remember Unwired giving similar guidelines, that you should roll every few turns.

Note that I'm talking about Agents/ICE with Analyze program, not the Analyze running off the node. I suspect the Node is too busy to be constantly Analyzing icons in the background.

The Spider can use a Simple Action to do an Observe in Detail (for Matrix Perception so Computer+Analyze) to look for intruders.

This is particularly impacting on games with a TM. A TM with multiprocessing can do it as a Free Action and do it twice per pass. They make great guards.

Getting in the firewall is an extended test but normal Matrix Perception isn't. You get one shot to see the guy per action and you either do or don't succeed. This means TM's that are buffed are best countered by de-rezzing (or spoofing) the sprites aiding them so the intruding TM has to rely solely on Threading to exceed their base CF. Since threading has a sustaining penalty without the Swap echo it means a hacker can whittle away at a TM unless the TM uses one of the few sprites that have Stealth and can get them higher than rating 6.

Come to think of it Data Bombs might be a good counter as well... if the player is sloppy and doesn't think to look.

sprites need not be in the node the technomancer is hacking in order to assist the technomancer. a living persona is like a normal persona, and a normal persona can be in multiple places at once. so you could have your living persona in the node you're hacking and, let's say your home (living) node, with a couple of sprites there boosting your CFs. in order to get at the sprites, a defending spider would have to break your stealth so he can track you, hack into your living node, and *then* engage the sprites found there.

The topic of Analyze detection by IC was discussed at some length here in the Matrix Explained thread of yore.

The thread was a project that I did and have since discontinued. I have not read The Wireless World or whatever the new matrix expansion book is titled and thus am unable to comment on the rules with any kind of authority or clarity. In any case, for core-book rules the thread linked above ought to provide some answers.

Jaid's post quoted above is the most brilliant post EVER...

Actually, a Technomancer's home node cannot be hacked, except by other Technomancers. So it's even worse.

oh gawd

I would think that it would analyze any signal entering the node, the usage of any unauthorized access of certain programs, scan the network for unauthorized users, and then scan the authorized users for validity in that particular order. Wants to keep people out first and for most and then wants to make sure that nothing important is being touched w/o proper clearance, and then look for the people sneaking around in the system. Makes sense right?

In our game (as we are figuring out the matrix ourselves), we allow the node to make a Matrix Perception Test any time the intruder uses the Hacking Skill (and the Perception test is opposed normally with Hacking + Stealth). [I see a page reference confirming this on pg 74, Unwired]
This tends to make for PCs creatively using the account privileges to accomplish as much as they can with the occasional use of Hacking skill to push the boundaries.

For IC, we use it based on the instructions they have been given:
Most IC in our games tend to roam the node constantly scanning icons. The IC both scan for hidden icons and scan known icons for anomalies (such as illegitimate/hacked accounts, missing passkeys, multiple users of the same account). It could be figured out exactly how often this scan occurs against the intruder (each Perception test is a Simple Action), but our GMs pretty much wing it based on the amount of traffic in the node and the number of IC watching over it.
The other type of IC we see are ones linked to specific devices/files/service. These IC are basically "holding action" and get a Perception Test to notice any Hacking attempt against that device/file/service followed by a normal Perception Test on the icon that is manipulating the device/file/service (the second perception test is regardless whether the icon is using Computer or Hacking). A common one is to see IC linked to the Access Log.

This is why as a techno, you take stealth at 6, and thread that booch up to 11. You could do 12, but saying it goes to 11 is so much more fun.

jago668.karma++;