Result categories
Transport speed settings
Theprobe-transport-speed setting controls how probe packets are sent:
Probe speed
The defaultprobe-speed: 8 is recommended for most servers. Higher values reduce the number of request cycles (faster scans), while lower values reduce scan pressure — useful if players experience disconnections.
Special cases
Bedrock players
Bedrock clients use a different network stack and should be excluded from Java-only scanning. Enable thebedrock.detect option in config.yml and ensure Floodgate or Geyser is installed.
Bypass detection
A separate module estimates whether a scan result looks incomplete or deliberately manipulated. See Modules — Bypass Detection for details. This is distinct from blocked-mod detection.False positives
A false positive occurs when a mod is reported as detected when it is not actually present. Common causes:- Detection identifiers that are too broad
- Multiple mods sharing similar identifiers
- Modpacks that bundle files from other mods
False negatives
A false negative occurs when a mod is present but not detected. Common causes:- The mod hides or obfuscates its behavior
- The client is blocking scan packets
check-modeis set to a mode that excludes the target mod- The wrong identifier is configured
Best practices
- Use
check-mode: "RELEVANT"or"BLOCKED"for daily use — scanning everything inmods.ymlis slow - Use multi-entry identifier lists for mods that behave differently across loaders
- Keep
blocked-mods.ymlfocused; avoid adding mods you do not actively enforce - Test new identifiers with
/aml probebefore deploying to production