Game Development Stack Exchange is a question and answer site for professional and independent game developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am building an MMO and want to add NPCs. The thing is I don't know the basic design. What does the calculations, the clients or the server? I would understand the server calculating events and reactions, but when it comes down to pathfinding and position and movement of player, who calculates that?

Who calculates the AI the server or client? I couldn't imagine the server calculating the pathfinding, position, movement and so on. Please I need help understanding this, thanks, anything will help.

share|improve this question
Careful with your terminology - NPCs aren't players, for example. – Kylotan Aug 15 '11 at 10:00
up vote 22 down vote accepted

Most MMOs these days have anything important done server-side, for safety reasons. You can't off-load much to the client, which is why one of the first things axed are AI routines. I think most developers consider client-side to be hackable as a rule, not an exception.

Scalify's Badumna ( ) tries to off-load part of it on the clients in that they'll have calculations done client-side and sent to each other; some data is also sent to an authorative peer to be validated before it's passed on to clients, just like a dedicated server. The issue is that ALL data in a multiplayer game MUST be sent through an authoritative peer if you want to prevent cheating. I brought up Badumna as it seemed the closest to what you might want, but even that won't be able to catch cheaters -- it might catch some, but anything critical (ie. everything, pretty much) has to be done server-side.

I might expand some on Badumna, because it could still be something you'll find useful (but I urge you to reconsider off-loading anything important on the clients, because the clients WILL cheat).

Badumna offers a hybrid architecture for data operations. It provides complete control to the developer in deciding what is critical (and must be verified) and what isn't (and so can be sent by the decentralized network).

If an MMO requires that every single bit of information has to be verified then Badumna will function as a client-server solution. However, I believe that there are different categories of MMO applications with varying requirements. For example, quite often an MMO will have combat zones where players are likely to cheat and hence every bit of information has to be verified. However, there are also zones where players can only walk/run/dance/chat. Such zones do not require complete verification and can utilize Badumna's decentralized network and benefit from the scalability that it can offer.

Secondly, Badumna provides additional security features that developers can access such as identity protection (so that users cannot pretend to be someone else), complaint proxy (allowing clients to be configured to report malicious/cheating players to a trusted source), and black listing (banning malicious players from the games).

I've not really explored Badumna that much, so there migh be issues and features I'm unaware of, but at least I've given a cursory glance on it.

tl;dr: the client should really just be a keyboard and mouse hooked up to the internet.

share|improve this answer

The short answer is that for a standard MMO, the AI calculations are always performed by the server.

Some games will have the client try to predict the AI, so that NPCs will appear to react more quickly, but that's just an illusion; the real NPC is always controlled by the server.

share|improve this answer

An MMO is a public- (Internet-) facing server. Anything that you want to be able to control completely should not be accessible to the public, otherwise you risk allowing an attacker to control NPCs. Unless you're doing some sort of encryption on your commands (which will impact performance), you can't trust the client to be running only your own code.

Predicting NPC movements on the client to compensate for lag is a great idea; you could theoretically include as much of the AI behaviour as you wanted in the client program and have them sync up periodically - but allowing the client to dictate the behaviour of an NPC would grant the client the potential to mess with the game world. If the client descynchronises from the game world on the server then you'll end up with uncontrollable rogue NPCs.

Which is a shame, really, because distributing AI over clients could impact scalability.

share|improve this answer
Encryption is mostly useless - the client needs to be able to decrypt anything sent to it, and the client can be reverse engineered. At best encryption will slow down someone creating a cheating client. – Adam Aug 17 '11 at 23:54

Usually the server should calculate or validate every data passed to or received from the client. But It depends on how much you can trust the client and how important that calculation is. Sometimes the main calculation could be done on the client and the server might be able to use a simple method to validate the resulting data.

share|improve this answer

To build on the other answers, the "offload and verify" strategy could indeed be useful, in situations where the verification is easier than the original calculation (or where only occasional spot checks would be enough to catch cheaters).

For example, if you had the client do A* pathfinding and send the results to the server, all the server would have to do is check that a) the path is valid, and b) there is no shorter path. Checking path validity should be easy, and checking optimality could be easier than finding the optimal path to begin with, since you now have an upper bound on the length of the paths you need to check. (In particular, if the client returns a straight-line path, it is obviously optimal as long as it is valid.) To be honest, I have no idea whether this particular trick would be useful in practice, but I see no fundamental obstacle to it.

Do note, however, that if you offload NPC AI to the clients, then a hacked client could potentially use it to predict NPC behavior in advance. For some types of games or situations this could be a serious issue.

share|improve this answer

It's probably best to have some simple AI routines and game-critical calculations on the server side, while handling the complex non-game-critical operations on the client side.

For example, the server knows where a hostile NPC is and where the player characters are. When the player character gets within range of the NPC a server-side calculation can be done to see if the NPC should attack the player, and a simple pathfinding routing can be done to determine how long it will take the NPC to reach the player.

Once the NPC has been transitioned to the attack state the client can deal with animation and fine-grained path finding. When the NPC is close enough to the client to attack the server can perform calculations to see if the attack hit, what the damage was, etc...

You'll want to make sure that any calculations that truly effect the outcome of the game are handled by the server and passed to the client, while the non-critical calculations are handled by the client.

In the simplest case you'll be keeping the client in sync with where it expects the server to be, the server will verify, then the client will calculate again.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.