Open the Minecraft multiplayer menu and every server in your list shows a name, a player count, a version and a small icon, before you have joined any of them. That whole row arrives from one exchange called Server List Ping, and it explains most of the strange things that row sometimes does.
What the client is actually doing
When the multiplayer screen loads, the client opens a TCP connection to each server on your list, says hello, asks one question, reads the answer and disconnects. No login, no world data, no authentication. The whole conversation is four packets and it is over in the time it takes the row to stop saying "Pinging...".
The reply is a single JSON blob. Mojang documents the wire format, and the community-maintained protocol reference at wiki.vg is the version most tooling is written against. Inside it:
| Field | What it holds |
|---|---|
version.name | The version string the server chose to advertise |
version.protocol | The numeric protocol the server actually speaks |
players.online / players.max | The counts your client prints |
players.sample | A short list of player names, if the server sends one |
description | The MOTD — the two lines under the server name |
favicon | A 64×64 PNG, base64-encoded |
Every one of those is supplied by the server. Not one of them is verified by anything.
Why the version string lies more often than you would think
version.name is free text. version.protocol is a number that has to be right for the connection to work at all.
Servers running Paper, Spigot or a proxy like Velocity routinely advertise a version.name of something like "Paper 1.21.x" or "1.20-1.21" — a range, or a brand, rather than a version. That is why your client sometimes shows a server as incompatible in red while the server owner insists it works: the client compared protocol numbers and disagreed, and the friendly string was never part of that decision.
Proxies make this deliberate. A network fronted by a proxy answers the ping itself, on behalf of whichever backend server you would land on, and advertises whatever range the proxy has been told to accept. The row you are reading describes the front door, not the room behind it.
Practical consequence: the version in the list is a hint. The only real test is connecting.
The player sample, and the names that are not players
players.sample is optional and capped at a handful of entries. Hover a server in the list and you sometimes see names; that is the sample.
It is also the field most often used for something else entirely. Because it renders as free text on hover, a large number of servers fill it with advertising — "Join our Discord!", coloured rank names, or a rotating message split across the entries. Nothing in the protocol prevents it, and the client displays whatever arrives.
So a sample showing five names does not mean five players, and a sample showing marketing copy does not mean the server is dishonest about its counts. They are separate fields and they are lied about separately.
Fake counts and how to spot them
players.online is a number the server types. There are plugins whose entire function is to inflate it, and they work because there is no second source to check against — unlike the Valve query protocol, where a player list can be requested separately, Minecraft's sample is optional and truncated, so it cannot be used to audit the total.
The tells are behavioural rather than technical:
- A count that never moves, or moves in a suspiciously smooth curve
- A count that is always a fixed fraction of the maximum
- A large count with an empty spawn when you join
- A count that changes when you ping from a different address
That last one is the strongest signal, and it is what a directory that sweeps on a schedule ends up measuring anyway. Readings taken every fifteen minutes over weeks produce a shape, and inflated servers tend to produce a shape that real communities do not: no weekday dip, no timezone peak, no dead hours at four in the morning.
The favicon is a real network cost
The server icon is a base64-encoded PNG inside the JSON. A 64×64 image is small, but base64 adds a third to its size and the whole thing travels on every single ping, to every client, every time a multiplayer screen opens.
For a server with a large list presence that is a meaningful amount of outbound traffic for a decorative element. It is not a reason to skip the icon — a list row without one looks abandoned — but it is a reason to export it properly rather than uploading a 64×64 crop of a 4K render at maximum quality. The difference between a well-compressed icon and a careless one is several times the bytes, repeated forever.
Legacy ping, and why very old servers still appear
Before the modern JSON handshake there was an older, uglier exchange using a 0xFE packet, and clients from that era still send it. Modern server software generally still answers it, which is why a 1.21 server can appear in the list of a client from a decade ago — with a mangled name and a wrong version, but present.
This is also why servers for games and versions everyone assumes are dead keep turning up. The protocols were designed to be answered by anything, and that backwards compatibility has outlived several eras of the game.
It is worth contrasting with the Valve query protocol, which offers a separate player-list request that can be used to audit the headline count. Minecraft has no equivalent, which is why its numbers are harder to check.
What operators should take from this
Your MOTD is the only copy most players will ever read. Two lines, rendered in a list next to forty competitors. Colour codes work, and restraint reads better than a wall of gradients. Say what the server is, not that it is the best.
Advertise a version string that matches reality. If you accept 1.20 through 1.21 via a proxy, say so plainly rather than picking one and letting the other half of your players see a red X.
Do not inflate the count. Beyond the honesty of it, the practical case is that inflated servers convert badly: a player who joins a "1,200 online" server and finds a quiet spawn does not stay, and does not come back. The number that gets someone to click is not the number that keeps them.
Do not inflate the sample either. A hover list of fake names is the same claim as a fake count, made somewhere fewer people look — and it is read by the people who were curious enough to hover, which is exactly the audience worth keeping. The wider case against it is in what a full server actually means.
Answer the ping quickly. A server that takes three seconds to reply is a server most players scroll past, because the row is still saying "Pinging..." when their eye has moved on. Slow pings usually mean the main thread is busy, which usually means something else is wrong.
The short version
One TCP exchange, one JSON reply, entirely self-reported. It gives you a name, a count, a version, a sample and an icon, and it verifies none of them. Read it as the server's own description of itself — useful, worth having, and not evidence.
The Minecraft server list here is built from the same ping every client sends, which means it inherits exactly the same limits. What it adds is time: the same question asked repeatedly, so a claim that never changes starts to look like what it is.
Published · 6 min read