Catching Cheaters on Your Rust Server: What EAC Misses

Every Rust server runs Easy Anti-Cheat, and cheaters still turn up. EAC is good at catching known cheats on the player's PC. It is not built to catch a player whose cheat it does not yet know, and it cannot see the patterns an admin notices over weeks: the headshot rate nobody else has, or the stash found through two metres of ground.

That gap is yours to fill. Here is what the game gives you, what it misses, and how to build a case you can act on.

What the game already does

• Easy Anti-Cheat runs on the player's PC and bans known cheats across every server. Those bans are Facepunch's and you do not see them happen.
• Rust's server antihack checks movement and combat on the server: noclip, flying, speed, shots fired from an impossible position, melee from too far away. Each breach is a violation, and enough violations in a short time kick the player.
• F7 reports from players go to Facepunch. Plugins can see them too, which makes them useful to you.

The weak spot is memory. Antihack violations fade within minutes and are gone after a restart, so a player who trips it a few times a night never adds up to anything. A lag spike trips it too, so one violation on its own proves nothing.

What to look for

No single sign is proof. Look for several that point the same way, over time:

• Antihack violations that keep coming back, from one player, across different nights. One bad evening is lag; a pattern is not.
• Headshot rates well above the server's, especially at long range. Compare against your own server's players, not a number from the internet.
• Finding what cannot be seen. A player who repeatedly digs up buried stashes or heads straight for hidden loot rooms may be seeing through the world.
• Repeated F7 reports from different players. Reports from one angry player mean little. Five players reporting the same person in a week mean more.
• A family-shared account from a banned owner. Steam family sharing lets a banned player come back on someone else's copy of the game.

Collecting evidence

• Keep records. Note names, Steam IDs, times and what happened. Memory is unreliable and chat moves fast.
• Spectate. An admin can spectate a player and watch unseen. Record it with your own capture software; watch for tracking through walls and aim that snaps between targets.
• Bury honeypots. Hide a small stash somewhere no one would stumble on and see who digs it up. Nobody finds a stash in the middle of an empty field by chance twice.
• Keep the logs. Save the console and plugin logs from the nights in question before they roll over.

CheatAlarm does this bookkeeping for you. It keeps every antihack violation the game forgets, compares headshot rates against the rest of the server by distance, counts F7 reports and family-shared accounts, and lets you bury honeypot stashes from chat. It adds all of it into one score per player that fades over time, alerts admins only when the score crosses a line, and keeps every flag with its evidence. It never bans anyone itself.

Acting on it

• Be sure first. A wrong ban costs a player and your server's reputation. When the evidence is mixed, keep watching.
• Ban by Steam ID, not by name, since names change: banid 76561198000000000 "name" "reason".
• Keep the evidence with the ban, for the appeal that will follow.
• Say so, briefly. A short public note that a cheater was removed tells honest players you are paying attention. Leave out how you caught them.