problem with join flood and netsplit

[SaPrOuZy]

hey there,
for the guys that have done mass join protection scripts,
how do you know that the users that join a split server,
aren't a mass join when the server returns.
am facing this prob:

-----------------------------------------------------------
[22:03] Netsplit detected at brain.hub.eu.dal.net (CtrlF3 to see who split) <------- Dilemma was split
[22:04] »»» Joins: male-33 (~male-33@217.194.155.27)
[22:05] »»» Joins: lonly_man (~disperado@202.148.15.34)
[22:08] »»» Joins: M-35-LEB (~M-35-LEB@195.69.208.20)
[22:09] »»» Joins: imissu_19_m (~2hlean@62.84.75.150)
[22:10] »»» Joins: Realise (~Realise_@82.214.211.1)
[22:12] »»» Joins: small-bird (~small-bir@82.146.165.58)
[22:12] »»» Joins: msn-man (love@212.36.207.255)
---------------------------------------------------------- (the server rejoins here)
[22:13] »»» Joins: Dilemma (sin@alert.codered.cx)
[22:13] »»» Joins: Euphoria (misery@stupid.lackies.com)
[22:13] »»» Joins: paloma2010 (paloma2010@ppp-128-101.terra.net.lb)
[22:13] »»» Joins: Acx (angelz@uses.encrypted.botpack.biz)
[22:13] »»» Joins: lebanonlady (~.....@62.84.77.61)
[22:13] »»» Joins: Atlantica (blue@64.124.16.54)
[22:13] »»» Joins: Xandra (angelz@exploited.ssh.and.hack3d.us)
[22:13] »»» Mode (brain.hub.eu.dal.net:#Beirut +ooo Dilemma Atlantica Xandra)
[22:13] »»» Mode (Dilemma:#Beirut +RM-k [Flood.Stopped])
[22:13] »»» Mode (Dilemma:#Beirut +bbbbb *!*@212.36.207.255 *!*@82.146.165.58 *!*@82.214.211.1 *!*@62.84.75.150 *!*@195.69.208.20)
»»» [Banned]: msn-man
»»» [Banned]: small-bird
»»» [Banned]: Realise
»»» [Banned]: imissu_19_m
»»» [Banned]: M-35-LEB
[22:13] »»» Mode (Dilemma:#Beirut +b *!*@202.148.15.34)
»»» [Banned]: lonly_man
[22:13] »»» Mode (Dilemma:#Beirut +b *!*@217.194.155.27)
»»» [Banned]: male-33

so the people that joined after the bot split trigered the flood prot when the server rejoined

how can this be taken care of?

one of the solutions that i did but i prefer not to use, is to bind rejn to a proc that will stop the protection for a little while (5 secs) but the risk would still be there (if the fisrt 5 rejoiners weren't seen as splited nicks)

[Sir_Fz]

I think that the rejn bind depends on the wait-netsplit setting (correct me if I'm wrong) so IMO the best solution to this is to increase the wait-netsplit time (thus the rejoins will not trigger join binds).

[demond]

there is no way to know if joining clients - that the bot has no record of being on channel previously, therefore [bind rejn] is irrelevant - are legitimate people who have joined on the split, or drones that are join-flooding

i.e. you can't know which of the 2 possible scenarios is happening, unless you know for sure the network is rejoining; and you generally can't know if the network is rejoining - well, maybe you can in some cases - when you see a server mode

of course, all of that is valid on the presumption that [bind rejn] is not triggered, i.e. there hasn't been one client that has splitted

in the end, such scenario - people joining on the split, while not one of them has actually been seen by the bot splitting - is highly unlikely, hence no real need of recognizing it, it would happen very rarely

[Alchera]

Because of DALnet's oh so reliable Network (now there's a laugh) and almost hourly splits I've turned off flood join which gets around the whole problem:

Code: Select all

set global-flood-join 0:0

Other methods for checking for (possible) spam bots need be used.

[SaPrOuZy]

n the end, such scenario - people joining on the split, while not one of them has actually been seen by the bot splitting - is highly unlikely, hence no real need of recognizing it, it would happen very rarely

the thing is that what if the protection bot was on the server that split.
and pple joined on the other linked servers. the bot will think there's a flood. so it's not rare specialy if the server took a more or less long time to rejoin.

Because of DALnet's oh so reliable Network (now there's a laugh) and almost hourly splits I've turned off flood join which gets around the whole problem:

Code:
set global-flood-join 0:0

in that case no one would have bothered making join flood scripts

[demond]

the thing is that what if the protection bot was on the server that split.
and pple joined on the other linked servers. the bot will think there's a flood. so it's not rare specialy if the server took a more or less long time to rejoin.

either way, the only way you can distinguish between join and rejoin is to set wait-split to some acceptable for your network value (default is 300 = 5mins)

[demond]

Because of DALnet's oh so reliable Network (now there's a laugh) and almost hourly splits I've turned off flood join which gets around the whole problem:

Code: Select all

set global-flood-join 0:0

nah, that's irrelevant to splits, and to mass join flood too, since eggdrop would only track consecutive joins from the same hostname/ip

[Alchera]

With cycber cafe's it's a problem as they all get banned (they're all clones) hence, bot's in cafe channels should not check for flood-joins. Coming back from large splits, the bot sees it all as a mass join flood.