egghelp/eggheads community

Big Flood problem.... help me ;-)

2002-01-14T05:17:00-04:00

These days the Bulgarian IRC Network (UNIBg) is also suffering attacks like this one showed above. Many big channels got flooded off and even channel #Bulgaria was so badly flooded with abot 200 different bots from different hosts (bncs, proxies). The flood there was about 30 min and no one could do anything to stop it. Even one server got splitted due to the flood. The bots are msg-ing the channel with different msgs, when you set mode +m the begin nick flood. slennox if you want channels to test your script - I suggest you visiting this network:) I found this forum by chance while I was looking for script to prevent this thing happen again. Now I've downloaded sentinel1.54 and I hope to works

Statistics: Posted by Guest — Mon Jan 14, 2002 5:17 am

Big Flood problem.... help me ;-)

2002-01-13T21:10:00-04:00

slennox, i might have a temporary (few months) testbed for you (fast and multiple servers on fast link)

(I admin a /22 university network)

drop me a line on spy@cafeetje.nl

Statistics: Posted by Guest — Sun Jan 13, 2002 9:10 pm

Big Flood problem.... help me ;-)

2002-01-08T13:54:00-04:00

caesar, thanks for doing what you could, but results/logs from current version aren't really useful to me. In any case, I now have an ircd with some other people helping.

killer, regarding bans on similar nicks(ABCxxxxxx, etc.), it's far too easy to get around such bans using truly random nicks. You can bet every flooder would soon switch to random nicks if they know their semi-random ones will be automatically banned by a script, so its usefulness would be short-lived.

Statistics: Posted by slennox — Tue Jan 08, 2002 1:54 pm

Big Flood problem.... help me ;-)

2002-01-08T13:19:00-04:00

Slennox, I found the program that makes these clones here it's the url so you can give it a look.

http://clonesx.ezlomaz.com/clonesx.html

bye bye
killer

Statistics: Posted by Guest — Tue Jan 08, 2002 1:19 pm

Big Flood problem.... help me ;-)

2002-01-03T14:50:00-04:00

I noticed that the flooder has always the same part of the nick
eg. ABCxxxxx (in this case _0wn3d...) so we could code something that
will just ban the first part of the nick in case of flood...

See you
killer

Statistics: Posted by Guest — Thu Jan 03, 2002 2:50 pm

Big Flood problem.... help me ;-)

2002-01-02T18:55:00-04:00

--- Setings ---
# Bot CTCP flood.
set sl_bcflood 1:60

# Bot MSG flood.
set sl_bmflood 4:20

# Channel CTCP flood.
set sl_ccflood 1:60

# Channel avalanche/tsunami flood.
set sl_avflood 3:60

# Channel text flood.
set sl_txflood 10:60

# Channel bogus username join flood.
set sl_boflood 3:20

# Channel join-part flood.
set sl_jflood 3:20

# Channel nick flood.
set sl_nkflood 3:20

set sl_tsunami 10
set sl_ban 1440
set sl_boban 1440
set sl_globalban 0
set sl_wideban 1
set sl_banmax 100
set sl_igtime 240
set sl_ilocktime 120
set sl_mlocktime 60
set sl_shortlock 1
set sl_bfmaxbans 19

--- Setings ---

Statistics: Posted by caesar — Wed Jan 02, 2002 6:55 pm

Big Flood problem.... help me ;-)

2002-01-02T10:53:00-04:00

Slennox, I will be more then willing to help you with the floodchannel, please contact me on EFnet.

Statistics: Posted by GTM — Wed Jan 02, 2002 10:53 am

Big Flood problem.... help me ;-)

2002-01-02T10:16:00-04:00

I'll paste the main setings when I'll get home.

Statistics: Posted by caesar — Wed Jan 02, 2002 10:16 am

Big Flood problem.... help me ;-)

2002-01-02T08:23:00-04:00

caesar, it wud be helpful if you paste the settings of sentinel.

Statistics: Posted by Yourname — Wed Jan 02, 2002 8:23 am

Big Flood problem.... help me ;-)

2002-01-02T02:01:00-04:00

I'm @ of a big channel in a brazilian irc network. We suffer with attacks like this. When the attacker has many proxys, bncs, and since wingates, with a lot of IPs, is dificult to stop the atack. The best way i've found is to set the channel in +R mode, where only registered users can join the channel, and start banning the IPs in the Bot perm Ban list
This is not the perfect way, but it handles the attack and prevent further ones with those hosts.

Statistics: Posted by Guest — Wed Jan 02, 2002 2:01 am

Big Flood problem.... help me ;-)

2002-01-02T01:59:00-04:00

I'm @ of a big channel in a brazilian irc network. We suffer with attacks like this. When the attacker has many proxys, bncs, and even wingates, with a lot of IPs, is dificult to stop the atack. The best way i've found is to set the channel in +R mode, where only registered users can join the channel, and start banning the IPs in the Bot perm Ban list
This is not the perfect way, but it handles the attack and prevent further ones with those hosts.

[ This Message was edited by: hmelo on 2002-01-01 23:00 ]

Statistics: Posted by Guest — Wed Jan 02, 2002 1:59 am

Big Flood problem.... help me ;-)

2002-01-01T15:12:00-04:00

Well.. I tested 1 eggdrop with 10 flooders, with diferent hosts. My test results are: the ctcp flood protection works very fast with +mi and bans + kicks.. the join part flood works very good as the ctcp protection, but the avalanche/tsunami flood is not so good. He only puts a +mi and that notice to the channel.. flooders are still there with no bans at all.

Statistics: Posted by caesar — Tue Jan 01, 2002 3:12 pm

Big Flood problem.... help me ;-)

2001-12-31T06:02:00-04:00

I got an Unreal irc server and i'm an ircop in there so I can make what @host adress I want, with no clones or something like this. I'll test today 3 bots to 10-15 flooders, all with diferent adresses, on sentinel v2.60 (29 March 2001) and I'll report back what happend.

Statistics: Posted by caesar — Mon Dec 31, 2001 6:02 am

Big Flood problem.... help me ;-)

2001-12-30T19:58:00-04:00

Ignoring *!*@* is probably not a good idea at exactly the kinda time every o|o user will be msging/chatting the bot for ops

Statistics: Posted by Petersen — Sun Dec 30, 2001 7:58 pm

Big Flood problem.... help me ;-)

2001-12-30T19:32:00-04:00

I don't know where the 500000 number comes from, that's just silly.

The maximum number of flooders one can reasonably expect is in the area of 2000-3000. I have a reasonable expectation of seeing sentinel.tcl handling this fine, provided there are no inherent limitations in Eggdrop and the ircd (e.g. sendq issues) that prevent it.

The ignore feature has been scrapped completely from the next version of sentinel.tcl. It is not ideal for such massive floods, and I never liked it anyway.

Things I am toying with now include suspension of msg/notice/ctcp logging during a flood, and the option of silence *!*@* and ignore *!*@*. I'm sure there are other possibilities.

Statistics: Posted by slennox — Sun Dec 30, 2001 7:32 pm