Hello all,

Last night in the midst of a run that went south, the Hacker needed to break into a node for the team to be able to escape. Trying to hack on the fly, he triggered the node's active alert the turn before he was able to log in. Once inside, he was doing his best to try and hack while the loaded IC was trying to achieve enough successes to locate him through his 6 Stealth rating. At the same time, a security Spider logged on to the node with a 4 Stealth.

Since the team's hacker was too busy trying to hack the node rather than making Matrix Perception tests, I didn't give the player a chance to find him while the IC and Spider spent each IP looking for the intruder. The Spider found him first and immediately launched an attack against the offender.

This is the crux of my question. Since the Spider launched an attack at the Hacker, the Hacker's player believes that he should be able to attack in response without having to find the Spider's Stealthed icon. My belief is that since he never found the offending icon in the node, there's nothing for him to attack.

I assume the actual rule is somewhere in the middle, but I wanted to ask for the next time it came up in game.

Thank you.

I would say that because the surroundings are illusory, the attack is illusory, and the attacker are illusory that a Matrix Perception test should still be required.
It takes some concentration and awareness to pierce the veil.
Even on a 'pure code' level noticing malicious code can be a hefty chore.
Finding a sniper or a submarine is not automatic.

However, if the paradigm of the node was semi-realistic and the IC appeared as a gunslinger bursting into a saloon 'guns a blazin' then I would give it to them without the need for a perception test as STEALTH was obviously not running.

I see STEALTH being the key to this. IF they are using their finite processing power to run stealth instead of more softs in the cybercombat suite then it should matter for something.

Your computer doesn't tell you why your buffer overflowed, the program just crashes. Since he's such a sharp hacker, he can probably deduce that he's under attack, but he's got to make that perception test to figure out which idle .dll file in the node just destabilized his operating system.

I would posit that you do not have to make a perception roll against anything that would be obvious... if you are attacking, you have forgone your stealth and are therefore obvious...

There are several edge situations that this may not apply to, but in general, in a Node, I would give the target the benefit of the doubt here and allow him to perceive the attacker after he made his original attack...

To do otherwise should penalize both attacker and target in ways that gets very complicated... and it tends to spead up the scene a bit as well... there is nothing more boring than having 1 person in an extended and protracted combat scene while everyone else just sits and watches...

I don't have SR4a (just good ol' 4th ed) and I don't know which version you are using, but my two cents?

Yeah, he knows where the attack is coming from. An attack is a very big thing in the matrix, and I would rule that following the datatrail back to the source to be extremely easy. WHY? Because if you rule the way you do, then the PCs are going to pull the same stuff on you. And really, do you want your PC able to crash all the system's IC without them being able to fire a shot?

If you want a rule's definition, it says in 4th ed (again, not alpha) on page 227, that Stealth is used to bypass firewalls and to evade Analyze and Track. It says nothing about being a combat program, or else every hacker would be running Stealth for his cybercombat suite.

In the same way one has to determine where an unknown shot came
from with a perception test (with various modifiers such as silencing),
I would say that even in the matrix this paradigm holds true.

PCs with admin access can already do that and more.
Also why would a stealthy PC even make his presence known by
Crashing programs and IC when he can just slide past?

And yet, a Perception Test is never required for Obvious Things... Generally, this is applicapble for general combat... the edge situation would be the Sniper. MOST combat is inherently obvious to all participants...

I am operating from the assumption that a spider or IC running stealth is the equivalent to a sniper. Stealth is actively obfuscating your actions.
Using this assumption, this is one reason why none of the sample IC in unwired run stealth and armor at the same time. *Interestingly track is also not run concurrently with stealth or armor.
The IC is either using armor to protect itself while acting as a noticeable deterrent or using stealth to protect itself while protecting something.

And yet, the second that they attack, they have abrogated their stealth...
Snipers are a problem in the real world... in the realm of the Matrix, I would never allow them to operate in tandem as such... you are either being stealthy and not fighting, OR you are fighting and not being stealthy... Stealth is great prior to being spotted, once you have been spotted and the photons start to fly (as it were) then stealth is a thing of the past...

If you were a really clever spider and you spotted the intruder while remaining stealthy yourself, WHY would you ever attack them? I would call in the Heavy Guns (IC) and then initiate a Track of the intruder's location, and since he cannot see you, you have no worries of being attacked yourself...

Keep the Faith

I'd treat it as a surprise attack from a hiding and still stealthed character shooting a silenced and thermally suppressed weapon.

It shouldn't be obvious because Stealth limits Trace User and Matrix Perception tests. I wouldn't use subs as an analogy, more like two enemy snipers a la Enemy at the Gates. Subs can go active and see everything right? If he drops Stealth only he's visible, it doesn't make spotting the other guy any easier.

Not apocalyptic. Your targets only know that SOMEONE is out there SOMEWHERE with a long rifle and a ghillie suit. They don't know where you are, or what you're shooting, just that you're there. They get to make perception checks to find you, because they know to look for a sniper now, but they don't automatically trace your bullet path.

Now, if you were to drop Stealth when attacking, that would be the cybercombat equivalent of charging out from behind cover with a battle cry, but if you keep it up, you're still hunched down in the brush.

the thing is, you *do* have to make perception tests to detect the obvious in the matrix, *if* the obvious has a stealth program running especially. even without though, you need to do a perception check to see what something's AID is, or what kind of (visible) programs it's running, etc.

I think this all comes back to what you translate a "matrix attack" into. People who are more into computers and read into the fluff view it as buffer overflows and data corruption causing damage to the icon. Of course, if they are attacking with Black Hammer that must be some pretty intense data corruption to make my brain bleed, but I'm hot simming, so I can still buy that. In this paradigm, one could envision the attacker to still be stealthed as he is sabotaging code.

If you are looking at a matrix combat action as two icons wailing away at each other, then that shifts the paradigm. Slotting an attack chip has been described in the past as "your icon now suddenly might have a big hammer" and certain elements of the fluff have detailed cyber combat as two icons actually engaging in battle. When they hit one another it results in a disruption of code. In this set up, I don't see how you could be stealthed and attack an icon.

Really I think it all boils down to how scientific your tables approach to the matrix is. If you like the science aspect of the whole thing and are thinking of it as a hacker duel, it is much more analogous to a battle of snipers on a hidden plane. If you look at more cyber-punk elements, it is two people battling like in Tron...

I'm not sure if there is an actual RAW solution to this, it seems to me to be a GM flavor call.

Fortunately, the book doesn't explicitly support my POV or yours, so we can continue to play the game as we prefer without having to house-rule anything.

The book states that:


As a counterpoint also note that:


So the situation that the OP specified should not have happened according to RAW.
The hacker in question would not have been denied a chance to spot the attacker
had they had analyze set to automatically scan regardless of how distracted they were.

We tend to use your second example... to use the previous tends to prolong matrix activities greatly... which is not so much fun for everyone else... I do NOT want a return to the previous editions' matrix combat...

And in our games, Analyze does this automatically and continuously, assuming that it is loaded and running...
Saves a lot of time when time is a commodity...

We only tend to make additional Matrix Perception tests when we want to know more specific information, like an AID or exactly what programs are loaded, or exactly what that Icon is itself doing...

Again, we default to the basic rule that things that are obvious need no perception role... and I would argue that the Icon with the slotting big attack program whaling away at you is pretty damn obvious, and since it takes a complex action to attack, it is obviously mimicing melee combat... the Icons are obviously interacting with each other... the fact that there are no apparent combat penalties while engaged in matrix combat leads me to believe that the action is up close and personal, no matter what your "Attack Program" appears to be...

This may be a house rule, but I don't think so, it is just our interpretation of the RAW... it may not work for everyone though...

Keep the Faith

Emphasis added. Analyze may automatically scan every icon that enters the node, but if it doesn't beat the spider's threshold, it tells you that a disk defragging utility just loaded up. If a hacker and a spider are both Stealthed and scanning for each other, the one who finds the other first has a HUGE advantage.


You're changing the way the stealth program works. Perception in the real world has a law: if I can see you, you can see me. By definition. If photons can get from you to me, then they can of course go from me to you. Not so in the matrix. If you load up an Attack program, YOU see a huge sledgehammer, but if you've got Stealth running as well, I see a month-old log file and a bit of line noise until I beat your Stealth rating with a matrix perception test.


An interpretation of the RAW is not the RAW, therefore it is a house rule.


I quite agree here. If your table is happy with the way the matrix works, party on.

All RAW is interpretation... and application of what you interpret...
Interpretations may vary, but that does not invalidate that interpretation... on either side... at that point it is just preference...

Wouldn't this be handled with an ordinary surprise test ?

Stealth is only useful as long as you aren't noticed by pretending to be a background program or whenever you make a run for it to elude a Trace.

With Reality Filters this is actually much easier to explain, and from what I've read, most Nodes are created / dressed up in a way that make at least a little sense to a Matrix user's metahuman brain.



The quote is just a little bit how my own Technomancer usually perceives the Matrix and what happens when he is slammed with a high rating Reality Filter ran by someone else. Personally I think that Reality Filter 0 is what is run on most nodes. As in, you see what the creator / owner of that node intended you to see, unless you don't want to see that.

Thanks for the responses all.

Mainly the question was which of us was mistaken in how the rules worked, and judging from the responses it looks like the situation was more on the player's side than mine. After digging through the main book (4th Ed, not the Anniversary Edition) and Unwired, the closest situation I could find is the Security Example on page 79 of Unwired where both the IC and security Hacker notice the Stealthed intruder without any sort of checks and can attack immediately.

Which doesn't particularly seem right to me, but if I want to fix that I suppose I'd have to get a job at Catalyst.

I think you have found a glaring issue with that example of play.
Good find.

I don't know how often catalyst updates their errata, but that is something worth looking into.
Specious examples of play are really bad for new players.