RCON

This feature is exclusive to Java Edition.
 
It is dangerous to expose RCON ports to the internet. RCON is not encrypted and can be a subject to on-path attacks.

Remote console (RCON) is a TCP/IP-based protocol that allows server administrators to remotely execute commands. Introduced in Java Edition Beta 1.9 Prerelease 4, it's an implementation of the Source RCON protocol for Minecraft.

server.properties

Main article: server.properties

To enable RCON, you need to edit your server.properties file:

enable-rcon=true
rcon.password=<your password>
rcon.port=<1-65535>
broadcast-rcon-to-ops=false

The default port is 25575.

Packet format

Integers are little-endian, in contrast with the Java Edition protocol.

Responses are sent back with the same Request ID that you send. In the event of an auth failure (i.e. your login is incorrect, or you're trying to send commands without first logging in), request ID will be set to -1.

Field name Field type Notes
Length int32 Length of remainder of packet
Request ID int32 Client-generated ID
Type int32 3 for login, 2 to run a command, 0 for a multi-packet response
Payload byte[] NULL-terminated ASCII text
1-byte pad byte NULL

Note on ASCII text: Some servers reply with color codes prefixed by a section sign in their replies (for example Craftbukkit for Minecraft 1.4.7).

The section sign is sent by those servers as byte 0xA7 or 167. This is not part of the US-ASCII charset and will cause errors for clients that strictly use the US-ASCII charset.

Using the ISO-LATIN-1/ISO-8859_1 charset instead of the US-ASCII charset yields much better results for those servers.

Alternatively removing byte 167 and one subsequent byte from the payload will remove all color tokens making the text more human readable for clients that do not subsequently colorize those tokens.

Packets

3: Login

Outgoing payload: password.

If the server returns a packet with the same request ID, auth was successful (note: packet type is 2, not 3). If you get a request ID of -1, auth failed (wrong password).

2: Command

Outgoing payload should be the command to run, e.g. time set 0

0: Command response

Incoming payload is the output of the command, though many commands return nothing, and there's no way of detecting unknown commands.

The output of the command may be split over multiple packets, each containing 4096 bytes (less for the last packet). Each packet contains part of the payload (and the two-byte padding). The last packet sent is the end of the output.

Fragmentation

Maximum C->S packet payload length: 1446 (total: 1460) - outdated?

Maximum S->C packet payload length: 4096 (total: 4110)

The Minecraft server can fragment responses across multiple packets. There's no simple way to know when the last response packet has been received; approaches include:

  1. Wait until we receive a packet with a payload length < 4096 (not 100% reliable!)
  2. Wait for n seconds
  3. Send two command packets; the second command triggers a response from the server with the same Request ID, and from this we know that we've already received the full response to the first command.
    • The second packet should use a command that will not produce fragmented output
    • An alternative is for the second C->S packet to use an invalid type (say, 200); the server will respond with a 'Command response' packet with its payload set to 'Unknown request c8'. (200 in hexadecimal)

Example implementations

C
C#
Dart
Go
Java
JavaScript
Kotlin
PHP
Python 3
Rust
Scala

Navigation

This article is licensed under a Creative Commons Attribution-ShareAlike 3.0 license.
 
This article has been imported from wiki.vg or is a derivative of such a page. Thus, the wiki's usual license does not apply.
Derivative works must be licensed using the same or a compatible license.