mass join ban script

vraciu · Post by **vraciu** » Tue May 19, 2009 3:26 pm

hi guys. i`m trying for a long time a script that can detect a mass join and ban the users that trigger the mass join protection but i couldn`t so i come here with lots of hope somebody can help me...because the channel gets flooded with drones and it`s difficult to ban all of them...Thank you in advance

DaRkOoO · Post by **DaRkOoO** » Tue May 19, 2009 3:33 pm

You have that option in ur config file allready..Search for join-flood =)

vraciu · Post by **vraciu** » Tue May 19, 2009 3:42 pm

i know that... but the eggdrop does not ban the bots that join-flood...and i`m not talking about clones ...from the same ip address i`m talking about for example 10 different conections that join a channel in less than 2 seconds they send a channel message and after 2 min they part...

DarkRaptor · Post by **DarkRaptor** » Tue May 19, 2009 11:10 pm

hi,

You could try sentinel.tcl. It should be already in your eggdrop's scripts folder.

vraciu · Post by **vraciu** » Wed May 20, 2009 9:32 am

already done that still not banning the bots but thx anyway for the interest

TCL_no_TK · Post by **TCL_no_TK** » Wed May 27, 2009 8:42 am

I've thought about this kind of script myself, i know there a alot of good ones out there. But none are a 100% effective, in the end it really dose come down to the channel operators to detect and punish botnets when they join. I know this is found alot in eggdrop documents, but it seem relivant here to say that you should choise your ops carefully! not only on the bot, but for your channel.

arfer · Post by **arfer** » Wed May 27, 2009 9:47 am

The first line of defence in countering such events is a limit script. These will set the maximum joins to say 5 at any one time and reset the join limit after say 2 minutes (both are usually configurable).

You could not get 10 joins in 2 seconds with such a script.

However, the first five clones/drones would be able to join and a limit script by itself could not stop the messages. As I said, it is merely the first line of defence.

I find that once the owners of such bots using coordinated attacks learn that you have a limit script in operation, they get bored and give it up as a bad job.

Post by **Sir_Fz** » Wed May 27, 2009 11:46 am

This is of course possible, however in most cases it might affect innocent users (especially after netsplit rejoins). In my AllProtection script, I do have a mass join flood detector but it only locks the channel and does not place bans. The reason I've done it that way is because through experience I've seen a lot of incorrect bans being set when mass floods occur (either because a few users joined right before the flood occurred or after rejoins from long netsplits). Also, in some cases, too many bans might flood out the bot. I'd rather akick a few abusive hosts instead.

Btw, Sentinel does place bans in such floods.