WackyNetworkProfiler

WackyNetworkProfiler is a passive Valheim network diagnostic mod for dedicated-server owners and players investigating disconnects, RPC spam, bandwidth spikes, slow RPC handlers, mod compatibility issues, and suspected mod network behavior.

It observes and reports only. It does not throttle traffic, block RPCs, kick players, or swallow Valheim exceptions. YOU GET THE MOST USE OF IT ON THE SERVER.

Why server owners use it

The mod keeps bounded per-peer and per-RPC evidence that is useful when a problem disappears before an administrator can inspect the console:

• incoming and outgoing RPC call rates and bandwidth
• one, five, ten, thirty, and sixty-second windows
• payload average, minimum, maximum, peaks, and large-packet evidence
• incoming handler duration and observed exceptions
• per-peer socket queue, send rate, and health state
• RPC storms, routed-RPC fan-out, baseline deviations, and optional redundant-payload evidence
• optional sampled BepInEx plugin/assembly/caller attribution
• disconnect forensics and a rolling event timeline
• passive ZDO manager counters

The profiler is willing to report that there is no evidence of ZRpc trouble. Attribution, fan-out, and suspicion scores are correlation evidence, not proof that a player or mod caused a problem.

Player/client use

A player can install the mod client-side while troubleshooting a specific server or modpack. No command is required to produce normal automatic reports:

• a session report updates periodically by default every 15 minutes
• severe and critical incidents queue an update, rate-limited to once per minute
• disconnects update the session report and write a separate text forensic report
• a final update occurs when the plugin unloads

Players can send the session JSON and text report to a server owner or mod author.

Installation

1. Install BepInEx for Valheim.
2. Copy WackyNetworkProfiler.dll to BepInEx/plugins/.
3. Start Valheim once to create the configuration file.
4. Review BepInEx/config/a.WackyMole.WackyNetworkProfiler.cfg if server-specific tuning is needed.

Install on a dedicated server for server-wide peer statistics. For remote rpcmon terminal output, install on both the dedicated server and the authorized administrator's client. Normal players do not need access to commands for automatic local reports.

Session reports and exports

The profiler consolidates automatic, manual, severe-incident, disconnect-triggered, periodic, and shutdown JSON updates into one file for each play session:

BepInEx/WackyRpcScanner/Reports/session-<session-start>.json

A matching continuously updated human-readable summary is written beside it:

BepInEx/WackyRpcScanner/Reports/session-<session-start>.txt

Disconnects also create a separate text forensic report. CSV and one-off JSON exports are written to:

BepInEx/WackyRpcScanner/Exports/

Report retention is controlled by Maximum Report Files, defaulting to 100 files.

Session JSON includes report time, session start time, profiler version, current streams, attribution, suspicion evidence, and the retained timeline. Streams are sorted by total bytes so important traffic is visible first.

Endpoint privacy

Include Endpoint In Reports is enabled by default. When Valheim exposes the socket endpoint, peer labels can include it:

Stranger (1142147159) @ 66.52....

This helps a client identify the connected host and helps a server owner distinguish peers. Disable that setting if endpoint information should not be stored or shared.

Admin terminal commands

All rpcmon commands are server-only and admin-only. rpcmon without arguments is equivalent to rpcmon status.

Status and traffic

• rpcmon status � Current busiest streams, scanner sample count, profiler time, and dropped samples.
• rpcmon top calls � Streams ordered by current calls/sec; use for suspected spam/update loops.
• rpcmon top bandwidth � Streams ordered by current bandwidth.
• rpcmon incoming � Only remote-to-local streams.
• rpcmon outgoing � Only local-to-remote streams.

Peer and health investigation

• rpcmon peers � Current calls/sec, KB/sec, and exception totals by peer.
• rpcmon peer <name/id> � Top streams for a matching player name, identifier, or endpoint.
• rpcmon health � Socket health, queue bytes, send rate, and last incident severity.
• rpcmon zdo � Passive ZDO manager counters: sent, received, and client change queue.

RPC, hash, and attribution investigation

• rpcmon rpc <name> � Stream details: rates, payloads, handler time, exceptions, and sampled attribution.
• rpcmon hash <signed-hash> � Shows tracked evidence for an unresolved stable RPC hash and any learned name.
• rpcmon alias <signed-hash> <name> � Adds a local runtime alias for a known unresolved hash.
• rpcmon trace <rpc> � Samples at most one outgoing caller per second for that RPC.
• rpcmon trace stop <rpc> � Stops tracing.
• rpcmon warnings � Retained warning, storm, health, and fan-out timeline.
• rpcmon errors � Current retained timeline, including handler-exception incidents.
• rpcmon baseline � Baseline-learning status.
• rpcmon baseline reset � Clears learned baselines without clearing traffic metrics.

Reports and reset

• rpcmon report � Updates the current session JSON and text report immediately.
• rpcmon export � Writes a CSV export.
• rpcmon export json � Writes a one-off JSON export.
• rpcmon reset � Clears in-memory metrics and timeline; it does not delete existing report files.

Important configuration

Monitoring

• Enable Monitoring � passive collection switch.

• Ignored RPC Names � comma-separated exact RPC names or hash:<value> labels to collect without warning logs or incident escalation. Example:

  SomeExpectedRpc,hash:-667652280
  

• Include Endpoint In Reports � records exposed socket endpoint information; enabled by default.

Spam, bandwidth, and latency

• Spam Calls Per Second, Spam Calls Per Five Seconds, Spam Calls Per Minute
• Storm Calls Per Second, Storm Bytes Per Second
• Warning Bytes Per Second, Warning Bytes Per Minute, Large RPC Bytes
• Slow Handler Milliseconds

Reporting and logging

• Enable Periodic Reports � enabled by default.
• Periodic Report Interval Seconds � default 900.
• Report Severe Incidents � enabled by default.
• Report On Shutdown � enabled by default.
• Warning Repeat Interval Seconds � default 60. Sustained incidents log initially and then at most once per minute per stream instead of once per second.
• Startup Grace Period Seconds � default 90. During initial startup/world synchronization, suspicious traffic is labeled STARTUP_SYNC, logged at info level, and does not create health incidents or severe automatic reports.

Advanced

• Enable Payload Hashing � disabled by default because package hashing allocates.
• Payload Hash Maximum Bytes, Payload Hash Sample Rate, Redundant Payload Threshold
• Transport Sample Interval Milliseconds, Congested Send Queue Bytes
• Routed RPC Fanout Peer Threshold
• ZDO Sample Interval Seconds

Interpreting results

High call frequency with small payloads indicates call spam, not necessarily a bandwidth flood. Large but infrequent payloads can be more harmful than many small RPCs. Strong evidence usually combines several close-in-time signals: high rate, large traffic, slow handler, exceptions, queue growth, storm events, and sampled attribution.

An unresolved hash:<value> means the profiler did not safely observe a name registration. Use rpcmon hash <value> and, once identified, rpcmon alias <value> <name>. The profiler intentionally retains hashes rather than guessing names.

The first 90 seconds are normally classified as startup synchronization. If abnormal traffic persists after that grace period, it is treated as a regular incident.

Limitations

The profiler cannot reliably measure every transport-level condition. Packet loss, retransmits, encryption/framing overhead, platform-specific Steam/PlayFab failures, and definitive broadcast causality may not be exposed by the current Valheim APIs.

ZDO monitoring is intentionally passive counter sampling only. The mod does not patch ZDO serialization, ownership, dirty-state, or creation paths.

Optional Harmony patches are capability-checked. If Valheim changes a target method, the profiler logs the unavailable capability and continues with reduced functionality.

For questions or suggestions please join discord channel: Odin Plus Team or my discord at Wolf Den

Support me at https://www.buymeacoffee.com/WackyMole or https://ko-fi.com/wackymole