On various forums, and as explanations for limitations that SE faces when making new content, the terms "Server-side" and "Client-side" often get thrown around. This is a reference to where the data is kept or where the calculations are done. Some information is shared between the server and the client (almost everything the client displays), but client-side modifications do not have the potential to affect server-side values.
FFXI was released right at the start of the rise of broadband, so it was originally 56k (phoneline) modem compatible. Because of this, some parts of the game's program were designed to minimize communications between the server and the client (internet traffic) by performing some basic calculations client-side. Basically, though, the client program functions as a display and input terminal for the server.
Server Side Information
The server calculates things like Damage, HP healed, monster behavior, etc. You cannot affect Server-side calculations and information unless you are a moderately dedicated hacker. If it has been done, it has escaped the attention of the FFXI community. Any experiences that are shared between players are necessarily calculations done by the server and reported to you. Any information shared between players is necessarily sent client -> server -> client(s).
- Monster position (and spawn time)
- Monster behavior (like TP usage, aggression, what-have-you)
- Monster stats
- The positions of other players
- Party/Alliance structure
- Synthesis results
- Your level and main/sub
- Your stats
Much of this information is generated and sent to the client, where it can be viewed. Some of the information used in server-side calculations (like Monster stats) is never sent to the client and can only be inferred through rigorous testing.
Client Side Calculations
By and large, the client program (on your PC, PS2, or X-box360) functions as a display for the information it is sent by the server. The client may use the information given to it by the server to do basic calculations, that pertain to only you, and reports the results back to the server, but calculation like that are not very common and are generally low-security concern items when they are permitted. Client-side calculations that the server relies on are subject to potential third-party manipulation. Other third-party manipulations take extra data that the client is provided but does not display and displays it, like player TP and the MP of others in your alliance.
Anything that you interact with is based on information that you have gotten from the server. For instance, say you pull up a spell menu and some spells are white while others are grey. Your client program knows which spells to allow you to cast based on information it has gotten from the server. This is why it takes a little time after job changes at a moogle for your spells to change so you can warp. Your client asks the server if you can change your job, and the server tells you, "Okay, you changed your job. Here are your new stats and spell access." The lag between that lets you open up your Black Magic menu on Black Mage and see a bunch of greyed out spells that you should be able to cast.
As another general rule, any information that you see has been provided to your client by the server, so it exists on your Client program. You are capable of altering that information with enough technical know-how, but it won't necessarily alter the server-side version of the same information and may get you banned if it does and they detect it.
- Character position - POS hacking, Flee hacking
- Your Equipment - Spellcast
- JA/spell usage - Spellcast again, Autoexec, Scripts, Claim bots
However, just because something is client-side does not necessarily mean that it is unmonitored. For instance, if you could find the location of your level in RAM and adjust it from level 1 to level 99, the server probably wouldn't just go "Okay, now he's level 99, awesome!" While your client would see you as a level 99 character, any attempt to use spells or JAs that you shouldn't have access to would potentially flag you as irregular and get you auto-jailed. Similarly, if you run through a zone faster than some minimum time (which depends on the zone) or exceed some yalm/unit time metric, you're flagged as a Flee botter or POS hacker and auto-jailed.
What would happen if you Flee botted at Flee speed but didn't zone? Probably nothing.
What would happen if you set your level to 99? Nothing, because your level is never reported from client to server, but it would potentially be detectable server-side if it gave access to abilities and spells that you shouldn't be able to use with your real current job combination/level.