For node operators

Sysop operations guide

This guide describes administration of AR-Cluster 6.6. Setup supports new installation, upgrade, same-version repair, retained-data reinstall, guarded ProgramData migration and per-instance removal. Use the download page and release notes for release availability and qualification status.

Start with the existing node's configuration and data. Editing a display label does not rename its XML configuration tag. Settings and external data affect what users see; changes to peer permissions must be coordinated with the remote sysop.

Find the action you need

Menu organization: actions remain on the main menus, with separators instead of extra submenus.

The log viewer answers “what happened?”; Logging Options changes what is recorded. Security Monitor reviews enforcement; User Session History reviews connections and can support a security investigation without treating every reconnect as abuse.

Choose your starting point

For a new node, follow the clean setup walkthrough below. For a working node, follow the upgrade procedure; do not choose clean setup merely to obtain newer software. For an interrupted operation, start with recovery.

Set up a new node

1. Choose the callsign and optional SSID, the Windows account that will operate the node, and its listening ports. Each instance on one PC needs its own program directory and nonconflicting listening ports.
2. Download the current standalone Setup to a local folder outside any installation. Run Setup, approve UAC and select new installation. Choose an empty program directory. Review the displayed data location and shortcut scope; shortcut visibility does not choose the account that runs the server.
3. Enter the node identity and location fields requested by Setup. Review optional callbook choices: country and zone identification use CTY, while US state and Canadian province identification require the relevant local callbook data.
4. Finish Setup and start this instance with the intended Windows account. Verify the callsign and version. If automatic start is unavailable, use its shortcut after closing Setup.
5. Review Server Setup before enabling listeners or outgoing connections. Keep the node private until the intended ports, login messages and connection settings are correct.

Check the first connections

1. Agree on a peer login/callsign and endpoint with the remote sysop. Configure a supported node protocol; a peer connection is different from a user Telnet login or an RBN feed.
2. Use RBN Feeds for read-only CW/RTTY and FT feeds. Review connection names and enabled feeds. Received skimmer spots are filtered for local users and are never forwarded to cluster peers.
3. Connect a normal user client to the chosen listener. Confirm the login message, prompt and delivery of real received spots under that user's filter.
4. Inspect My Connections, connection details and the Network Map to confirm the expected sessions. A connected icon alone does not prove spot delivery. Compare real traffic and logs before changing health thresholds.

Use logs to investigate a failed connection and connection guidance to review its settings. Do not send invented DX spots to public peers as a test.

Daily operating routine

Check the node identity, connected users/peers, enabled feeds and recent spot activity. Health warnings are advisory: a quiet band or a deliberately small node can be healthy. Inspect the relevant connection and log before increasing thresholds. Keep a current backup and review disk space and retained recovery material before an upgrade.

Keep data or start over

Removal without data deletion retains the selected instance's configuration and data for reinstall. Reinstall into the same recorded location to reuse them. Selecting explicit data removal is destructive and should be used only when you intend to discard that instance's retained data; review Setup's warning and paths first. Other installed nodes are separate instances.

Install or upgrade one instance

Use the standalone ARC6-Setup.exe from the public Trial download page, or use Tools → Check for Updates → Trial. Trial .205 is currently published; Stable remains a separate unpublished channel. A manually installed version equal to the channel version reports no newer update; package revision labels do not force a repeat upgrade.

1. Keep a current backup. Record the callsign/SSID, executable and data paths. Stop only the selected node normally, close its application editors and pause any watchdog that could restart it during maintenance.
2. Download Setup to a local folder outside the installation, run it and approve UAC. The standalone EXE contains its payload; no adjacent ZIP is required. For the support ZIP, extract the entire kit outside the installation and keep it together.
3. Select the existing folder containing ArcServer.exe for upgrade or repair. A fresh node needs a new or empty program folder. Verify the selected identity and displayed destination on a multi-instance PC.
4. Keep Setup open through the final result. Database processing has bounded per-step limits; the displayed limit is not an expected duration. Do not start a node while maintenance is running.
5. After success, start through the selected account's shortcut if Start now is unavailable. Confirm version, connections, settings, Network Map and real traffic.

Requires Windows x64, Windows Server 2012 R2 / Windows 8.1 or newer, .NET Framework 4.8 or 4.8.1 and Windows PowerShell 5.1 Desktop. PowerShell 7 does not replace that prerequisite. No ARC4 conversion is implied.

Custom program folders upgrade in place. A legacy Program Files (x86) installation may relocate to Program Files; review the displayed paths. Existing data placement is preserved unless a separately selected migration changes it.

Choose the delivery method

The standalone EXE, compact manual ZIP and Check for Updates use the same upgrade validation and preservation rules. The manual ZIP contains self-contained Setup; its full supporting payload extracts automatically. A separate full support/updater kit is retained for recovery and updater delivery. Check for Updates obtains the published version for its selected channel, which may be older than a separately supplied manual test build. Do not copy individual DLLs into a working installation.

Before you stop the node

• Record its version, callsign/SSID, program folder, actual data folder, user account and listening ports. On a multi-instance host, label the target clearly.
• Pause its external watchdog or scheduled launcher, close editors and allow a maintenance window. Keep other instances running unless they share a resource you deliberately need to change.
• Check free space on both program and data drives. A staged upgrade and retained originals need additional space; the early estimate is not a substitute for final checks.
• Back up configuration, profiles and databases while the selected node is stopped. Keep the backup outside the installation and its maintenance folder.

Read the final result before restarting

Regional settings do not require translating filters or changing decimal/calendar preferences. Keep filter clauses and callsigns as entered. On an error, retain the complete log with build, delivery method, culture and final result. Normal upgrade helpers are precompiled; installing a C# compiler on the node is not a normal prerequisite.

New clean installation

Choose callsign and optional numeric SSID, operator account, peers/RBN and shortcut scope. New RBN names default to CW1RBN and FT1RBN. FCC/Canadian callbook downloads are optional; Skip leaves state/province unavailable when no local record exists. Prefix alone cannot establish a US state. Fresh data belongs to a new per-instance ProgramData directory and both empty operational databases. Incoming listeners begin disabled; configure them when ready.

Removal and reinstall

Use the selected instance's Windows Installed Apps entry. Removal retains data by default. Explicitly selecting verified owned-data removal discards that instance's stored data; other nodes and unowned folders are protected. Reinstall with retained data preserves identity and configuration. A clean install after data removal creates a new identity and empty databases.

Current manual kits and target selection

The compact manual ZIP contains complete self-contained Setup, support and independent recovery payloads; it is not the automatic-updater ZIP format. Extract it outside installations and run ARC6-Setup.exe. Updater-bound targets remain fixed. Manual Setup selects a sole verified registered instance using its actual path; zero/multiple choices retain Browse/manual entry.

Installed-version evidence and target/status are shown separately. Same-version repair remains available, and a newer installed version is not downgraded. A verified registered interrupted installation remains visible as Recovery required; partially published files do not establish its installed version. Upgrade is blocked until recovery is resolved. Reopen Setup after recovery.

Running-instance upgrades use the verified previous Windows launch context when available. For an instance already stopped before Setup, Setup may offer an unchecked explicit Start-now choice under the registered operator’s verified normal, unelevated account. Unsupported/elevated contexts still require the normal shortcut; a failed running-context capture never silently falls back. Registration, journal, ownership and executable checks remain authoritative.

Leave IIS running during an ARC upgrade. Upgrade only the selected node; other instances and WebCluster pools do not need a restart. A website deployment is a separate scoped operation.

Recover an interrupted installation

Read the final result. ORIGINAL_VERIFIED permits normal original-node restart after Setup closes. RECOVERY_REQUIRED means keep the node stopped, preserve its installation and .ARC6-maintenance folder, and run the current Setup against that same installation. Choose Recover interrupted operation, confirm it is stopped and wait for the explicit final success result. Recovery validates the retained original and restores it; it does not perform another upgrade.

Do not manually delete pending.json to bypass startup protection. Do not mix old executables and new databases. If you have already manually restored files, use supported recovery to reconcile the journal before startup. Recovery restores checkpoint data without merging activity recorded after the failed attempt.

Keep standalone Setup open while its recovery window is open. If using an older installer affected by missing temporary scripts, use the current installer or the complete support ZIP in a permanent extracted folder. If Windows blocks a downloaded ZIP's files, verify the download hash and unblock the ZIP before extracting it again. Current support loading clears the download mark only on the manifest/hash-verified support DLL; it does not weaken Windows policy.

Logs remain local under the installation's .ARC6-maintenance/SetupLogs; extracted support-kit logs may also appear in Support/logs. A preservation mismatch records expected/actual SHA256, size and timestamp. Retain the work folder and pending journal for diagnosis. There are no automatic success reports or diagnostic upload options. Share selected log text manually with your Trial coordinator.

Do not manually erase an instance’s maintenance directory or pending journal to make it appear clean. The registered recovery entry routes to the existing recovery worker; it does not bypass ownership or preservation checks. After recovery succeeds, close/reopen Setup to classify the actual installation before continuing.

Server identity and callsign changes

The Setup tree shows Server Callsign and Version first. The callsign is read-only in the grid: use its edit dialog. Enter the call and optional numeric SSID. Validation uses the shared callsign rules, and the country preview uses local CTY data; a prefix match is not proof of assignment or a live QRZ lookup.

Save and restart changes the configured node identity and disconnects users/peers during the restart. It preserves the installation GUID, profiles and history. The checkbox updates outbound client logins that exactly match the old node call; custom login overrides stay intact. Changing back with that option updates matching logins again. Remote peers can refuse or negotiate differently with a new identity until their sysop authorizes it.

Configured server identity is used at startup. A valid legacy license can supply initial identity without its bytes being changed. Once configured, identity removes the legacy-license dependency for startup. An invalid explicitly configured identity stops startup rather than silently reverting.

Connection names and addresses: RBN Feeds allows editing each connection name directly below its feed choice. Names require nonblank ASCII letters/digits and case-insensitive uniqueness; endpoint defaults do not reset a custom name. Connection details shows Remote host and the actual connected Remote IP, labelled IPv4/IPv6. Disconnected connections do not guess an address from DNS. Connection details is the single details action on My Connections.

Rates: DX/hour is an estimate from eleven completed one-minute samples; it excludes the current minute and can be zero on a healthy quiet link. Received-copy accounting includes duplicate PC11 reports; it is distinct from unique retained spots and does not prove a peer withheld a spot. RBN/skimmer reports, including every -# spotter, remain local-user-only.

Connections, RBN and cluster protocols

Connections separates outbound Outgoing Connections, inbound Incoming Listeners and RBN Feeds. Use the collection editor or the entry's ellipsis button. The Setup notice explains that edited outbound connections reconnect when Setup closes; listener changes other than enable/disable require a restart.

Two RBN feed families

ARC6.6 uses at most two RBN feeds: one CW / RTTY feed and one FT Modes feed. Feed ingestion is read-only. Users need a positive FTSKIMMER choice in the way a report matches to receive FT Modes; a blank filter or SKIMMER alone does not opt them in.

For the FT-mode transmit-offset field, configure telnet.reversebeacon.net port 7002 as the FT Modes feed. Existing port 7001 choices are not silently switched. The additional comment value becomes nullable TXOffset, in Hz above the bottom of the USB FT segment. It may exceed 3,000 Hz with wider receive bandwidths. It is preserved in history and client XML when available.

SET DX FILTER FTSKIMMER AND TXOFFSET>=0 AND TXOFFSET<=1000

This excludes reports with no offset. Users who want those too can use FTSKIMMER AND (TXOFFSET<=1000 OR TXOFFSET IS NULL), with their own band/spotter restrictions. Offset is not a CT1BOH quality assessment. FT reports still skip CT1BOH quality processing.

RBN/skimmer reports, including every received spotter call ending in -#, are for local connected users only. They must never be forwarded to cluster peers. A neighbouring node's RBN feed is not a substitute for your node's subscription.

Choose a peer or receive-only connection

Labels identify the protocol only. Welcome-message applicability and packet-engine details belong in the help pane. ARC6 capability does not guarantee negotiated PC9X: both peers and the relevant settings must permit it, and the ARC6 framed transport remains.

ARC6 Node (PC9X capable) connects to the remote ARC6 node listener. ARC6.6+ peers negotiate PC9X when both support it and the relevant settings permit it; otherwise the link uses ARX. ARC6 framing remains. The caption describes capability, not a completed negotiation: inspect actual connection details. Use PCxx/PC9x for DXSpider or CC-Cluster peers.

Telnet Spot Feed (Local Users Only) connects to a remote user port for receive-only spot ingestion. Imported reports go through local user filters and history; they never go to cluster peers, and local output is not sent back to that feed. Use distinct connection names and independently filtered remote accounts when needed. RBN endpoints still belong in RBN Feeds. Upgrades preserve enabled receive-only feeds; previously disabled entries require deliberate re-enablement. Supported login prompts include login: and Enter callsign:; an upstream using bare call: needs review. Real external feed combinations still require sysop acceptance.

Cluster Protocol

The renamed section holds the PCxx/PC9x options. Peer capability advertisements alone do not prove a negotiated PC9x connection; inspect the connection state and actual protocol exchange. Legacy PCxx and modern PC9x peers can coexist. Compatible ARC6.6 peers negotiate PC9X and exchange user-address information when available; legacy ARC6/ARC4 connections retain their compatible protocols. My Connections tooltips identify the negotiated protocol. Investigate repeated negotiation failure between compatible ARC6.6 peers. A reported address is advisory, not proof of identity.

Recent work improves PC11/PC61 duplicate/preference handling, revalidates queued spots against their source session and removes stale work on disconnect. PC9x topology calculations avoid repeated work for unchanged views. Callsign/SSID edge cases are tightened. A bounded field soak found no parsing errors, tracked-peer reconnect loops or captured RBN forwarding in its bounded samples; it did not establish a quantified traffic reduction or certify every peer combination.

Optional experimental peer identity

The Experimental ARC6.6 identity peers list in Cluster Protocol is empty by default, preserving legacy advertisement. Exact listed peers may use experimental identity 5960 with the actual integer build; changes apply when that peer reconnects. This is a limited compatibility test, not an agreed universal encoding. Older DXSpider versions may display it differently. Relayed peer identities are not rewritten, and broader DXS/CC soak remains separate.

Edit introduction and welcome messages

Both .txt and legacy .dat files are supported. Save As defaults to showing both, and a new extensionless filename receives .txt. Saving a new file does not automatically repoint every listener: select the intended path, then test a fresh login.

In a server listener's properties, select the value for Introduction Message File or Welcome Message File, then use its ellipsis editor button. Similar message-file properties use the same editor. These are files shared by any listeners pointing at them.

The large editor uses a 14-point fixed-width font, search, undo, a matching width guide and a supported-macro picker. Save As creates a separate message file. File saves take effect immediately; canceling the outer Setup dialog does not undo them. External-edit conflicts are checked before saving, and file saves preserve a backup.

The width defaults to 79 columns. Select text to Wrap to Width, Insert Box or Center Text. Width includes borders; the optional border allowance reserves room when wrapping. Long words/macros are rejected rather than truncated. Centering an existing supported ASCII box preserves its borders and centers the inside text. Macro expansion can change the final alignment or exceed the guide, so review the message with a real login.

Unknown macro names remain unchanged. These expansions also apply to login-error/logout text. Test a fresh user connection after editing; an already connected user does not repeat its welcome automatically.

Navigate Setup

Server Callsign and read-only Version appear first. Expandable headings are bold at every depth; ordinary settings remain regular. Related security controls are grouped with their modes, limits and shared lists. Configuration separates location, Maintenance & startup and advanced database paths. Cluster Protocol separates current protocol settings from legacy compatibility. Outgoing Connections, Incoming Listeners and RBN Feeds describe their direction/role.

The ellipsis on an IP/callsign-list property opens the existing validated Security Lists editor at its matching tab. Exit persists Setup configuration. The Setup window remembers size, location and the help divider, with recovery from off-screen monitor placement. Changes still follow each field’s restart/reconnect help; a label change does not change its serialized name.

Unused ContestMode and old public/private chat-group options are hidden while their compatibility XML survives. Legacy IP-file settings are hidden only after successful adoption; manage current imported rules under Security. About retains credits/copyright rather than exposing Legal as a configurable property.

Content and callsign policy lists

Setup → Content / call lists edits local MyBadWord.dat, MyCallBlock.dat, MyConnectBlock.dat and MyDxSpotBlock.dat. The managed base file is shown read-only. Import/export, comments and matching previews help retain source/reason notes. Base and local additions combine; removing a local rule does not remove its base counterpart.

Save validates the complete candidate, detects stale editor contents, replaces one list atomically and retains one previous copy. Invalid input leaves the active file unchanged. Unsaved switching/closing asks before discard. Reload applies after a quiet period without restart. Invalid external replacements can retain the prior memory snapshot but cannot undo bytes already written by another editor.

The reviewed bad-word feed supports boundary words/phrases and explicitly marked substrings; local unprefixed additions retain literal substring matching. Callsign block-list matching retains each legacy list’s semantics. These are permanent local policies without automatic expiry or a shared reputation network. Imported inbound IP rules are administered separately in Security; editing retired IP files after successful adoption has no active effect.

My Connections: geographic groups and reported users

Choose Alphabetical or Country Prefix in the panel. Country grouping uses loaded CTY, with Unknown Prefix for unresolved calls and a separate RBN group for the two feed families. Alphabetical view does not create the country-view feed group. Prefix resolution is geographic evidence, not proof of identity or license assignment.

Expand a peer to see its bounded reported user list. Updates use a slower snapshot cadence; peer nodes are not recursively nested into their own child peers. Reported users may have incomplete membership/IP evidence. Their context menu allows lookup, copy, details and local log filtering, but cannot disconnect/configure a remote socket. Direct connection menus retain appropriate local actions.

Tooltips distinguish transport, negotiated protocol, connection direction, status and available identity/address details. Reported users and unresolved countries are explicitly labeled; do not treat them as confirmed abuse.

State / Province / CTY adds US-state and Canadian-province/territory groups for direct connections with valid local lookup evidence. US calls without a resolved state and Canadian calls without a resolved province fall back to CTY prefix; unresolved CTY uses Unknown Prefix. Other entities use CTY. Callsign numbers do not establish current residence, and CTY is not a state/province directory. Existing feed groups and reported peer-user children retain their roles. Lookups can fill in asynchronously; missing local callbooks do not make a valid callsign invalid.

Network Map

Open Connections → Network Map. It is modeless: the main window can take focus. A snapshot refreshes about every ten seconds; Pause holds it and Refresh requests a current view. The graph shows this node’s known topology, including loops and unlinked reported nodes, rather than a complete worldwide inventory. Expired reports disappear and failed refreshes retain the previous view.

Green: ARC6.6; blue: legacy ARC6; brown: ARC4; purple: DXSpider; teal: CC-Cluster; gray: unknown. Software is classified from available evidence; generic/absent distant identifiers remain unknown. Solid links are direct and dashed links reported. Thicker arrows indicate a known connection initiator, not one-way spot traffic; remote initiation often cannot be inferred.

User count zero differs from unknown. Complete reported membership is preferred; a fresh keepalive count can supply display-only fallback. The details show count source/time and route evidence. A count does not authenticate users or create sender membership. Unknown counts/unlinked nodes can reflect incomplete advertisements rather than a local defect.

Window size/location and details width persist with monitor visibility checks. Drag interaction avoids replacing the view mid-gesture. Node search: type a case-insensitive callsign/SSID in the editable search list. Suggestions come only from the displayed view; an exact match takes priority, with stable prefix matching otherwise. Selecting a match highlights and centers it without changing zoom or graph coordinates. Blank/unmatched input clears the search highlight without moving the view. Pause searches the displayed snapshot. Search text is not persisted. Broader export/management features remain future work.

Neighborhood Hops to view supports 1–10 hops (default 2); other views retain their own behavior. Map tooltips distinguish direct observed identity from relayed reported software/build, count source and snapshot age. Colors are evidence indicators, not proof that every reported node is upgraded. Optional link-motion and layout controls are presentation choices; the map reflects this node’s knowledge.

Reference data, databases and scheduled maintenance

Reference Data groups Downloaded reference lists, Callsign lookup services, Downloaded block lists and Advanced / compatibility. Each source address stays alongside its automatic-download choice. History & Database Retention controls cached/database histories; Log Retention controls application/protocol files separately.

Generic reference downloads are eligible on an elapsed-week basis and run in the daily maintenance pass, with per-source timing offsets, bounded timeouts/size, conditional requests and a failure backoff. They do not run on every spot. Validated conversion happens before activation; download, challenge-page, truncation or parse failure retains the active last-good dataset. Standard hosted lists additionally use a same-origin integrity manifest; a hash does not prove source accuracy or provide a digital signature. Legacy compatible custom text formats remain supported.

Known source migrations are one-time and preserve automatic-download opt-outs and named custom-source overrides. Later sysop URL edits survive. Source migration alone does not force a download or immediately replace active data. The first normal startup records dataset/configuration evidence; local My files are preserved. Review sources after restoring an older configuration writer.

Daily schedule and startup loading

Maintenance Time (UTC) is daily housekeeping: retention, log cleanup, database work and eligible downloads. US/Canadian callbook refresh runs on Monday UTC. The generic elapsed-week cadence is separate; no configurable weekday is provided yet. Fresh configuration defaults to 08:00 UTC with a randomly selected saved minute. Existing schedules survive upgrades. The selector’s random-minute button changes the saved minute, not a new nightly delay.

Load supporting data on first use controls startup preloading versus loading eligible data when needed; changes require restart. It is unrelated to maintenance scheduling and does not disable a dataset. Text-cache edits automatically reload after a quiet period; failed candidates retain working memory, with retry and metadata reconciliation for missed notifications.

US/Canadian callbook and HamQTH

Under Callsign lookup services, US / Canadian Callbook holds automatic refresh, both official download URLs and Export Legacy ARC4 Callbook. Export defaults to False; enable it only for an ARC4 consumer. Existing saved selections are retained. Native ARC6.6 lookup does not require the export. FCC/VE imports remain a separate database pipeline, not ordinary small text-cache reload.

HamQTH Callsign Lookups is a sibling service with callsign, masked password and HTTPS URL. Fresh credentials are blank. Upgrade kits contain no trial-node account; upgrades preserve the destination sysop’s own settings. Do not place account passwords in screenshots, support exports or public documentation.

Build kits include an AD1C CTY snapshot. Upgrade replaces installed CTY only when the embedded release date is newer; equal/newer/undated installed files are preserved. Build-time daily caching is not a claim that new FCC/VE/SCP data is bundled with every kit.

Database paths

Cluster Database and User Database use separate native SQLite files. Legacy SQL CE installations are converted by the isolated compatibility reader during controlled maintenance, retaining original/recovery material. Do not point the running server at SQL CE files. Path changes require restart and do not move data; verify ownership and matching backups.

Security defaults and restart persistence

Clean installations versus upgrades

Clean installations enforce spot submission rate and total-command rate protection. Existing thresholds remain 30 distinct spots per spotter/origin and 90 per public IP in 30 seconds, with a 60-second spot cooldown; skimmer/DXTEST traffic is excluded. Total-command protection permits 27 nonempty local Telnet commands in 20 seconds, disconnecting before the excess command is queued. Identical-command safeguards remain independent.

Upgrades preserve saved spot/command Off, Observe or Enforce modes and thresholds. Login, session, reconnect escalation, quarantine and manual IP rules retain their enforcement defaults. Empty manual lists add no blocks. Station repetition, sender verification and login spot warm-up remain Observe; permission lists remain Off. Historical one-time migrations remain separate.

Restart-persistent security

Unexpired learned evidence, penalties, quarantine and temporary holds load before listeners. Original deadlines survive; downtime counts toward expiry. Current policy modes win. Sessions, per-run decision totals and recent events start fresh. Changing numeric policy rules discards incompatible automatic evidence while valid manual holds retain their expiry.

A separate per-instance Security/SecurityState.sqlite checkpoint saves every 30 seconds and after connections stop during normal shutdown. Trial .205 preserves valid concurrent learned events even when callers acquire the admission gate in a different timestamp order; it sorts detached save records and private restore views without resetting samples or extending deadlines. Crashes may lose learning since the last checkpoint. Acknowledged hold changes and quarantine clears commit before success. Save/restore faults are logged; incompatible/corrupt files remain for review while in-memory protection continues. Do not delete, casually restore or clone checkpoints across instance GUIDs. Normal configuration/history backup restores do not reactivate stale restrictions.

Duplicate logins

New/reset duplicate-login configuration defaults to RejectNew; saved choices remain. Users should coordinate client profiles and permitted SSIDs.

Security controls

Open Tools → Server Setup… → Security. Independent Off, Observe and Enforce modes disable, model or apply each policy. See clean-install defaults and upgrade preservation. Other safeguards remain independent; these settings do not change router rules.

Registered and Trusted lists are empty by default. Both permit local posting under permission-list policy and exempt the user from post-login spot warm-up; neither bypasses rate, station, IP, command, session or reconnect protections. Numeric SSIDs share the base callsign for local-user callsign policies. Listing a callsign does not authenticate its holder or grant remote sysop privileges.

Public-IP aggregate limits exclude private/hairpin addresses. Explicit manual rules can block private addresses. Local users are associated with their socket address; remote spotter addresses are origin-reported evidence. A relay peer's socket address is never substituted as the remote user's address. PC61 and PC92 can carry IPv4/IPv6 information, but an absent address stays unknown and a reported address remains advisory. Ordinary spot protections exclude skimmer and DXTEST traffic; the prohibition on forwarding skimmer/-# spots to peers remains in force.

Read Security Monitor decisions

Security Monitor shows observed/enforced totals, recent identities, cooldowns, quarantine and manual holds. Its first 200 displayed groups are a view limit, not persistence capacity. Unexpired protections survive restart; per-run totals, recent events and sessions reset. Observe models do not themselves reject. Copy/details, saved bounds and column sizing remain available.

Copy report copies a UTC snapshot for support review. It contains private callsign/address evidence: keep it off public websites and remove unrelated personal details before sharing. A missing-sender record includes origin configuration timestamp/age, advertised membership, keepalive user total/age and path/lease evidence. An Observe permission-list record means the local spotter is unlisted; it does not require registration or block the spot. Inspect those receipts before attributing abuse or enabling Sender Enforce on a mixed network.

Edit Security Lists safely

In Setup, open Security Lists.... Its manual IP, imported incoming IP, Registered and Trusted tabs support one entry per row. IP rows accept IPv4, IPv6 and CIDRs, with normalized subnet endpoints and address counts. Host bits are normalized, so 192.168.1.145/24 covers the entire 192.168.1.0/24 subnet, not one host. Use /32 for one IPv4 address or /128 for one IPv6 address. Hostnames and ports are not accepted.

Validation highlights invalid rows and explains normalization and duplicate merging. Callsign lists accept explicit callsigns, with numeric-SSID normalization and no wildcards. All four lists validate before anything is applied; invalid input prevents Save lists. Cancel leaves the lists unchanged. Save lists applies all four lists immediately, without changing modes; use Setup's Exit button to persist configuration. Test broad subnet rules on an isolated node first to avoid blocking your own access.

Logs and session diagnostics

Tools groups Open Log Viewer and Logging Options… together. Start with a narrow time/source/connection filter and expand to full files if the event is older than the loaded tail. User Session History is in Connections; select the relevant session and compare its times with the application log.

Search recent entries or full files

The built-in log viewer initially loads the last 1 MiB of each selected file, then retains bounded recent entries for responsiveness. Exact level filters that loaded set, including matching continuation lines; it does not imply the entire file has been searched. Use Search full files when investigating older errors, even if the file has not rolled. Includes/excludes edits settle briefly before updating the loaded view; Enter or leaving the edit can apply promptly. Multiline exception entries can differ from a physical-line count. The grid follows the window width, and font, size and window placement are saved with visibility checks after monitor changes.

Private data stays on the sysop host

All-user filter export is a local server UI action: File → Export User DX Filters… writes a sysop-selected file on the server filesystem. Entries identify the callsign and relevant user/filter details. Unreadable profiles are skipped and reported with identifying evidence; do not automatically reset a long-standing profile from a parse warning. It is not a Telnet export command. The legacy remote export entry returns only a compatibility explanation: it creates no file and reveals no other users' filters. It is intentionally omitted from the public user reference. Local exports, support bundles and diagnostic logs are private operator material; keep their destination outside any web-served directory.

Public SHOW CONNECTS and SHOW LOG replies omit connection addresses. SHOW LOG refuses address predicates. Session diagnostics are available only in the local UI. Private-data operations must never be implemented as user-visible Telnet replies, even when a user guesses an administrative command name. Authenticated sysop account privileges for remote administration are future work; this guide documents local UI actions only. Normal users can still save their own filters/profile settings.

ArcServer.log records application events. The default application-log configuration rotates by day and at 100 MB, with five size backups. ProtocolTraffic.log is separate and retains its smaller 10 MB rotation. Existing/custom logging configuration should be reviewed before assuming those defaults apply.

Log Retention sets backup age and combined disk-space limits; it does not set an individual file's rotation size. Scheduled cleanup preserves active logs and excludes custom names. Defaults are 10 days / 250 MiB for application backups and 7 days / 60 MiB for protocol backups.

Protocol capture can be enabled globally and per connection. User Telnet RX/TX does not automatically enable CW/RTTY or FT RBN capture. Opening a viewer enables no capture. A selected connection capture ends when that connection disconnects. Enable only the directions/transports needed for a diagnosis, note the callsign, version and UTC interval, and retain bounded evidence before rotation. The outbound PCxx node/user-message option concerns legacy synchronization diagnostics such as PC16/19/20/22; PC9x capture is separate. A PCxx transport label can still contain modern PC9x frames. Telnet TX to local users is not proof of forwarding to a peer.

Use Connections → User Session History to inspect recent login duration and disconnect reasons. Records are bounded and in memory only (up to one hour, 100 completed records per callsign and 10,000 globally); restarting clears them. This history is separate from the Security login-rate gate. Short sessions can be normal client behavior.

When investigating a command error, correlate Telnet RX/TX with the application timestamp and connection ID. Malformed SHOW/DX expressions receive help; unexpected failures remain logged. Use SHOW DX BAND=40, not another cluster's SH/DX ON 40M syntax.

Current connection/session diagnostics

Connections → Node Session History records direct peer TCP/connect-ready/disconnect times, direction, transport family, observed endpoint, reason and a distinct session ID for each reconnect. PC9X carried over PCXX remains labeled by its transport family; negotiated ARX is distinguished. History is bounded and memory-only, resets on restart and may be incomplete at capacity. A pre-socket DNS failure is a log event, not a completed peer session.

User Session History shows observed remote addresses and supports an exact remote-IP filter across retained user callsigns. It performs no DNS guess and is not proof of a person’s identity. The incoming rejection counter is process-wide since startup, not a count for the selected IP. Login timeout wording identifies the existing 60-second authentication deadline.

Connection Details and tooltips expose observed remote client and local listener ports; Summary is selectable/copyable. Log Viewer supports horizontal scrolling, source Component.Method and links to Logging Options. Successful history saves use minute-level INFO summaries; individual save detail is DEBUG and failures are reported immediately.

Window, panel and tray preferences

The main window saves normal bounds and its restored/maximized/minimized state at shutdown. If monitor/resolution changes would leave it off screen, startup falls back to a visible position on the primary monitor. Placement and tray preferences are per Windows user and installation.

A first manual minimize offers taskbar or system-tray behavior; the saved choice is available under the Window menu. Tray entries include the node callsign to distinguish instances. Restore by using that instance's tray icon; to exit, right-click it and choose its callsign-labelled Exit action. Check the hidden-icons area near the clock if it is not visible.

The title-bar X, File → Exit and tray Exit gracefully shut down the application, subject to the confirmation dialog. Don't ask again applies only after confirming Exit; the confirmation can be re-enabled in the Window menu. Identity restarts and Windows shutdown do not use that prompt. A critical cleanup failure is logged and reported, although some services may already have stopped. There is no flashing shutdown-status popup.

Pinned Health and My Connections panels reopen with saved docking/size. Unpinned, floating or closed panels do not reopen as floating windows; their tabs remain available. Use the menu to open them. Setup saves its size, position and help-area divider, with monitor working-area checks to keep it visible after display changes. Its default window is taller and the default help area is smaller; the property tree uses a two-point size increase without enlarging every application button.

The separate View menu controls toolbar visibility and text. The toolbar opens Setup, Map, Log Viewer, Logging Options, Security Monitor and User Session History. Icons-only is the default; preference changes are saved per installation/account. Log Viewer close/reopen and Logging Options retain the current viewer state.

Start an instance when you sign in

The upcoming candidate adds an opt-in Window → Start this instance when I sign in choice, also available from that instance's Windows Installed Apps maintenance action. It is off by default and applies to this Windows account and this node only. Enable it separately for each node you want to start. Keep listening ports distinct.

An elevated application session offers a clearly labelled administrator startup choice for nodes that require those permissions. Enabling that mode requires an elevated session; no password is stored. This starts the desktop application after logon, not as a boot-time service. Startup skips duplicate instances and interrupted maintenance. A fresh installation identity cannot inherit an old task at the same path. Interactive sign-in and UI acceptance for this candidate are pending; the published Trial does not yet contain this option.

Back up one instance and restore deliberately

Use File → Backup… to create and verify an instance backup while the server continues running. Configuration/user data is included; choose whether to include spot/propagation history. Keep the archive private: configuration and profiles can contain credentials and personal information.

File → Restore… is a controlled same-instance operation with shutdown/restart and preservation checks. It is not a way to clone another callsign or merge newer and older data. Check the archive identity, history choice and current instance before proceeding. Configuration restore has operator reports of success; broader history/host cases still need acceptance.

Open Data Files Folder shows the active data location. ProgramData and retained installation-local layouts are both supported; do not assume where a node stores its databases. Keep the installer version and matching recovery material. When making a manual file backup, stop that selected instance first; copying a live SQLite main file alone does not capture a verified consistent WAL-mode database.

Upgrade checkpoints preserve matching program/data recovery points but do not replace independent backups. Test uncertain restore cases only on isolated, same-instance copies with listeners/outgoing connections disabled.

Optional startup when you sign in

In the Window menu, enable Start this instance when I sign in for the account that normally operates it. This is off by default, applies independently to each instance/account, and starts after interactive Windows sign-in. It does not run before login or turn ARC6 into a service.

The administrator variant is explicitly labelled Start this instance as administrator when I sign in and requires an elevated session to enable. No password is saved. Use the account/permissions the installation actually needs; shortcut visibility for all users does not select a runtime identity.

Disable the option in the same account to reverse it. The saved choice survives upgrades and retained-data reinstall; uninstall removes the selected instance's owned startup entry. Identity, duplicate-process and interrupted-maintenance guards prevent stale launches. Avoid combining it with another watchdog/startup task that launches the same instance. Operator interactive sign-in acceptance is still pending for the private candidate.

Help users choose useful filters

Point users to the filter guide and named saved filters. Each SET DX FILTER replaces the complete expression. SKIMMER alone does not opt into FT; the matching alternative must contain positive FTSKIMMER. NOT SKIMMER excludes all skimmer reports, including FT.

FREQ WITHIN adds exact-frequency lists and inclusive ranges without changing old comparison/arithmetic meanings. The worked recipes distinguish human, CW/RTTY and FT selection. Frequency windows alone do not identify mode. Rejected filters leave the active expression unchanged. Do not change a user's filter without agreement; export files are local sysop material.

Troubleshoot by the symptom

For a useful manual report, include exact build, delivery method, node, approximate time, final result and relevant log text. Remove passwords and private user/address information. Logs stay local: no automatic reporting or voluntary diagnostic-upload feature is provided.

SQLite storage and legacy conversion

Current builds run on maintained native SQLite using WAL mode and synchronous=FULL. SQL CE is retained only in the isolated legacy conversion reader, not as the running server database. Setup converts a verified copied database pair, preserves the original archive and validates the candidate before publishing it.

Keep ArClusterDb and ArClusterLocalDb with their selected instance’s ownership/binding. Do not mix legacy and native files, point a second instance at the same database, or remove retained conversion/recovery archives merely to reduce ZIP size. Interrupted conversion follows normal recovery rather than a fresh-install overwrite.

History writes are bounded and transactional. Successful saves use a 500-pending-row threshold per cache or a periodic 10-second deadline; visibility depends on committed rows and workload. Read-only API/website reads do not force a save or weaken durability. Retention and pruning remain configured maintenance, not an automatic PRAGMA optimize policy.

Node identities, user reconnects and network limits

These identity rules are separate from optional base-callsign/IP abuse controls. A local node, configured peer or node known from current evidence cannot log in as a human under that same normalized fullcallsign. A duplicate direct peer is refused without replacing the established connection; legitimate connections to different neighboring nodes remain possible.

One local user session owns a full normalized callsign/SSID. RejectNew is the default for new/reset configuration, preserving the incumbent session. Upgrades retain saved ReplaceExisting/RejectNew choices. ReplaceExisting remains available for an idle completed Telnet user after save/cleanup; peers are never replaced. Rejected logins cannot execute startup commands, but attempts still count toward rate protection. Nonzero SSIDs remain separate identities.

Under Setup’s login settings, NetworkConnectionLimit defaults to three distinct known hosting nodes per user fullcall; zero disables that network cap. NetworkConnectionOverrides accepts sysop fullcall assignments such as W1ABC=2; W1ABC-1=1. Invalid/duplicate normalized entries are refused. Fresh known PC92/legacy membership is counted independently of local routing suppression; repeated ingress paths do not count as extra hosts.

This is admission using known evidence, not a global distributed lock. Existing basecall/IP rates, session limits and reconnect protections remain separate and can still refuse a login. Turning those policies Off/Observe does not disable identity/node collision checks. Saved policy changes affect future admission, not a sweep disconnect of existing users.

Optional per-instance read-only API

Setup → Read-only API provides authenticated GET-only status, committed spots, recent receiver spots, recent spotters and propagation. Defaults remain disabled at loopback 127.0.0.1:3994 with no token; assign a unique port/token per instance. Non-loopback requires operator-provisioned HTTPS/certificate/reservation/firewall settings. There are no administrative or spot-injection routes.

1. Choose the actual runtime Windows account and an unused port. Provision the exact HTTP.sys URL reservation for that account/path if needed; avoid wildcard or broad Everyone permissions.
2. Use the token editor to generate a 64-hex random read credential, or paste your own securely generated value. Show/copy applies only to a new draft. Cancel does not assign it; ordinary saves retain an existing token. Rotation is explicit and confirmed.
3. Transfer the token securely to a server-side consumer, then accept/save Setup. Update consumers after rotation. Clear clipboard contents after transfer. Existing tokens cannot be revealed here.
4. Save Setup to validate and apply enable/disable/rebind/rotation without restarting the whole node. Invalid/bind/account failures stop only the API and show a sanitized warning; normal node processing continues.

Windows DPAPI protects the token for the runtime Windows account. Copying encrypted configuration does not make it usable under another account/machine; reconfigure or rotate deliberately when creating another instance. Keep credentials out of URLs, browser JavaScript, cookies and logs.

Requests use Authorization: Bearer <token> and GET-only /api/v1/ routes: status, spots, recent-spots, spotters and propagation. Recent cache and committed history are distinct bounded views. Browser Origin/CORS requests are refused; use a trusted server-side consumer. Read credentials never grant administration.

AR-WebCluster: a read-only browser view

Open AR-WebCluster. Original WebCluster author Alan Rovner K7AR is credited first. The current IIS application reads the authenticated ARC API rather than opening the live cluster SQLite files directly. ARC and IIS protect their credentials separately.

Current presentation has compact phone/tablet rows, grid-only automatic refresh every two minutes, and a manual refresh action with a 15-second cooldown. Default, Light, Dark and System appearances are available. Filter/paging and independent device appearance are retained; this is a browser data view, not a Telnet session or an administrative console.

When deploying your own consumer, configure an appropriate ARC API version, exact runtime-account reservation, per-instance token/port and server-side protected IIS credential. Validate authenticated status/spots/propagation first. Use a dedicated pool and avoid direct database fallback. Leave IIS running during ordinary ARC upgrades; a website deployment may manage only its own scoped application pool.

HamQTH lookup from Security Monitor

1. Configure your registered HamQTH account callsign/password under Setup’s reference-data settings. This account differs from a user’s local profile and from the local FCC/VE callbook.
2. Open Tools → Security Monitor or its toolbar button. Right-click a row with a valid Caller and choose HamQTH lookup.
3. Read/copy the returned station fields in the separate read-only window. Requests run in the background so the monitor stays responsive. A numeric user SSID is removed for the station query; the selected fullcall remains in the window title.

Security Monitor has manual callsign entry even without a selected event; a valid selected caller prefills the editable lookup. Existing row actions remain. Lookups run explicitly in the background, never automatically per event. Configure the sysop HamQTH account first; failures do not reveal credentials.

After-upgrade review

First use a quiet test instance. Confirm a normal reconnect before restoring an external watchdog. Also check menu placement, map search at unchanged zoom, geographic grouping, Save As .txt/.dat visibility and protocol help. Test sign-in startup separately; it is optional and does not need enabling to test an upgrade.

• Confirm the intended software, the intended node identity and unchanged database/profile paths.
• Check normal inbound/outbound peers, RBN feed choices and real user spot delivery.
• Copy a SHOW/DX/FILTER command, edit it and confirm list inclusion/exclusion works as intended.
• Verify a fresh login message, empty-Enter prompt and any CR-only client startup commands.
• Review the saved maintenance minute, CTY version and logging retention settings.
• Check Setup help, message-editor controls, panel persistence and tray/exit behavior on your desktop.

Operator UI and live installation review remains necessary; focused non-UI build/package checks do not replace it. Keep logs and report the exact version, node and UTC time of a problem.

User Manual · Complete command reference

API data selection and consumer limits

Recent receiver-specific spots include memory-only skimmer observations omitted from committed history by duplicate handling. All server selection filters precede the 5,000 matching recent-spot window. Pin pages to the returned snapshot; it expires after 30 seconds and can be evicted earlier. The committed endpoint separately scans at most the latest 5,000 history rows; neither endpoint creates a combined full archive.

Recent spotter selection/directory and optional receiver coordinates carry source, precision and approximate-location information. Configure optional SpotterLocations.csv or RbnSpotterLocations.csv locally; no request-time online geocoder is used. The API never exposes a licensee mailing address.

Consumers can request gzip for larger successful JSON replies. Both spot endpoints accept callsignPrefixes=H4,7T,C5,S9, suggested by HA8TKS, intersecting with the exact callsign and other filters; ordinary spaces around comma-separated prefixes are accepted. Bounded receive-table, scan and worker limits apply; consumers should back off and retry transient failures.

Tokens stay in the trusted server-side consumer, never browser code, cookies, URLs or logs. Browser Origin requests remain refused. Read tokens never gain write rights. Download the complete API developer reference. See the WebCluster section for browser-view operation.

Move an upgraded instance to ProgramData

Trial .205 adds a guarded maintenance action under the selected instance’s Windows Installed Apps entry. Upgrade or repair that instance with the current Setup first, stop it normally, pause any watchdog, then choose Modify → Move this instance’s data to ProgramData. The action never stops or restarts ARC for you.

1. Confirm the displayed callsign, stable instance GUID, installed version, program folder and current data folder. Do not continue if the target is running or the identity/path is not the intended instance.
2. Keep a separate current backup. Setup revalidates registration, the cached Setup digest, data ownership and pending-operation state before copying.
3. Allow Setup to stage and verify configuration, databases, lists, logs, learned-security state and recovery sidecars. It verifies the copied files and databases before committing the new binding.
4. Read the final result and operation log. Success leaves the original data in place and ARC stopped. Start the node through its normal shortcut/account, then verify Open Data Files Folder, database paths, listeners, peers, users, logs and security-state reload.

The operation does not merge folders or remove the original. Do not manually combine the old and new trees. If maintenance reports a registration, identity, copy, database or recovery-state problem, leave the instance stopped and preserve both locations plus the Setup log for diagnosis.

PC9X topology performance in Trial .205

Trial .205 reduces temporary allocations and repeated projection work without changing PC9X messages, route precedence, user membership visibility or configured peer behavior. It reuses bounded reachability only when structural state is unchanged, builds warm route unions directly, compares retained projection components exactly and incrementally reconciles ordinary remote-user additions/removals.

Node, route, transport, local-user, identity, expiry and ambiguous changes retain the full projection path. Offline differential checks matched 2,484 service snapshots and 11,001 equality cases. NC7J-3 canary checks and an overnight active-node soak completed successfully; measured CPU, allocation and garbage-collection improvements vary with graph, peer, user and spot load.

No logging change is required to receive the optimization. Leave high-volume PCxx/PC9X logging off unless investigating a specific protocol issue; it can materially distort a performance sample. Use ordinary Health, Network Map and SHOW PC9X checks to confirm topology settles after upgrade.