I am having a hard time wrapping my mind around the idea of marks in regards to patrol ic. The Patrol IC text says, "While the act of placing a mark is an illegal activity, the act of simply having a mark is not. Once you have the mark, you are considered a legitimate user."

I was under the impression that in order to enter a node (host?), you had to use Brute Force or Hack on the Fly to get a mark on it first. If this is the case, then what would patrol IC be useful for? If having a mark isn't illegal, then what would tip off the patrol IC that something is wrong?

Alternatively, if I am reading this wrong, and marking the host isn't the same as having a mark, then is the patrol IC scanning every turn, using matrix perception (Computer + Intuition [Data Processing] v.(Logic + Sleaze)? Any net hits at all would mean it could tell "whether any silent running icons are in the area?"

Which of these seems right? Or am I totally off base here?

Patrol IC can use one of the hits on its Matrix Perception Test to ask 'What was the last Matrix activity performed by <icon>'. Meaning if you get a mark, and the IC spots you - it doesn't automatically assume you're an illegal user until it finds out what your last matrix action was. If the last matrix action was anything limited by or using [Attack] or [Sleaze], then it knows the mark is illegitimate.

When you say, "get a mark," do you mean by placing a mark on the host, or receiving one from the host?

Placing a mark. If you're invited to place a mark, then you haven't performed an [Attack] or [Sleaze] action, thus making the mark legal.

So how would a GM determine if any given IC would be scanning the player's particular icon during any given turn? I know the patrol ic CAN scan them, but I assume they are in charge of scanning large numbers of icons...

personally, i would assume they give priority to hidden targets, users, and checking for new hidden icons.

that is, they'll check users for hidden icons. if none are present, they'll go through the personas/user icons in the area before coming back to checking for hidden icons. if there are hidden icons present, they'll try to find them, and if they find them, will check them more often than non-hidden personas.

i would also presume that as soon as you log in, they also make a check if you are not hidden.

What Jaid said sounds reasonable to me. I think I would have Patrol IC check on a decker right when he enters the host, and then every (3d6 - Host Rating) combat turns thereafter. Check on you means either look for silent icons if you're running silent, or just check out your last matrix action and 'log' it if it was legal. Like, if it noticed you were doing Matrix Search looking for a particular file, and then later you use Crack File (an attack action) on that file, it would remember that and come right for you along with its more dangerous pals.