sentinel acting up - kick/ban others

[Bytez]

Hi, I'm using sentinel 2.70 on a botnet of 8 bots that are on the same shell provider. Recently, the bots been kicking others for no reason. The bots sits on a channel on EFnet with sysreset fserv and omenserve ads. (Flood:chan is OFF, set to 0:0 on every bot for that channel) Most of the time, the number of people in the room are 30-40. Today, the bot kicked 5 people with the following message:

fever was kicked by bot233 (AVALANCHE/TSUNAMI flooder)

then comes this:

bot233 sets mode: +b *!*winnt@*
[00:27] * fever was kicked by bot235 (banned:MULTIPLE IDENT/HOST flooders)

after the +b *!*wintnt*@ many people got kicked off the channel

Code: Select all

# Bot CTCP flood.
set sl_bcflood 5:30

# Bot MSG flood.
set sl_bmflood 6:20

# Channel CTCP flood. 
set sl_ccflood 5:20

# Channel avalanche/tsunami flood. 
set sl_avflood 6:20

# Channel text flood.
set sl_txflood 80:30

# Bot CTCP flood.
set sl_bcflood 5:30

# Bot MSG flood.
set sl_bmflood 6:20

# Channel CTCP flood.
set sl_ccflood 5:20

# Channel avalanche/tsunami flood.
set sl_avflood 6:20

# Channel text flood.
set sl_txflood 80:30

# Channel bogus username join flood.
set sl_boflood 4:20

# Channel join-part flood.
set sl_jflood 6:20 

# Channel nick flood.
set sl_nkflood 6:20

set sl_tsunami 10

I don't know why this has been happening recently, the bots didn't behave this way before; had them on for almost a year and I haven't been messing around with the sentinel settings. Anyone know what's up?

[Alchera]

sl_masktype (default: 0)
Selects the type of hostmask to use when banning and/or ignoring flooders. There are three to choose from:

0 - *!*@machine.domain.com / *!*@555.555.555.555
1 - *!*ident@machine.domain.com / *!*ident@555.555.555.555
2 - *!*ident@*.domain.com / *!*ident@555.555.555.*

The default option, 0, is strongly recommended for most situations, and provides the best level of protection. The other two options are provided mainly for special cases.

Valid settings: 0, 1, or 2, depending on the hostmask type you wish to use.

Make the masktype more specific. I use set sl_masktype 2 and have no problems. There are always problems associated with banmasks set like "*!*winnt@* "

[slennox]

The moment I read "fserv and omenserve ads" I pictures lots of colours, bold, and so on. These are the ingredients of a tsunami flood. Based on your settings, at least 6 users each sent a message containing 10 or more "control" (colour, underline, etc.) characters within 20 seconds. Every non-opped user who sent such a message just prior to the channel lock was assumed to be one of the flooders.

Increase sl_tsunami and/or make sl_avflood less sensitive.

[awyeah]

Yeah you also might want to adjust your fserv message displaying timers, maybe delay them a bit. Also your bot which has the sentinel.tcl loaded might be lagging on the shell server, or the irc client server. Which might have caused it todo such an act.

I know this because, it sometimes happens to me as well, when the bot lags due any of the reasons mentioned above.