Join Throttle

These are old archives. They are kept for historic purposes only.
Locked
Greggor
Posts: 8
Joined: Sat Sep 18, 2004 7:07 pm

Join Throttle

Post by Greggor » Thu Oct 06, 2005 10:39 pm

For some reason, the join throttle is just not working... It's set to +j 3:10 and +f [10j#R10,10m#M10,10t#b]

The idiot in question is using proxies and is impossible to ban. He just join/part floods the channel whenever he's bored and there's nothing I can do about it. I can't set the channel to +R because it's the help channel and people usually go there to ask how to register their nicknames.

[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
[6:21pm]Parts: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) (<Insert Racist Message>) «29 users »
[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
[6:21pm]Parts: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) (<Insert Racist Message>) «29 users »
[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
[6:21pm]Parts: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) (<Insert Racist Message>) «29 users »
[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
[6:21pm]Parts: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) (<Insert Racist Message>) «29 users »
[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
[6:21pm]Parts: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) (<Insert Racist Message>) «29 users »
[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
[6:21pm]Parts: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) (<Insert Racist Message>) «29 users »

And here's some more in case you haven't seen enough

[6:05pm]Joins: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) «34 users »
[6:05pm]Parts: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) (I LIVE IN MONTGOMERY ALABAMA) «33 users »
[6:05pm]Joins: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) «34 users »
[6:05pm]Parts: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) (I LIVE IN MONTGOMERY ALABAMA) «33 users »
[6:05pm]Joins: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) «34 users »
[6:05pm]Parts: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) (I LIVE IN MONTGOMERY ALABAMA) «33 users »
[6:05pm]Joins: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) «34 users »
[6:05pm]Parts: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) (I LIVE IN MONTGOMERY ALABAMA) «33 users »
[6:05pm]Joins: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) «34 users »
[6:05pm]Parts: greggor_sets_mode_n1ger (~ilovejews@Swift-8D245A7.dl.dl.cox.net) (I LIVE IN MONTGOMERY ALABAMA) «33 users »
<Server down for maintenance>

^ :D

Syzop
UnrealIRCd head coder
Posts: 1957
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Re: Join Throttle

Post by Syzop » Thu Oct 06, 2005 11:02 pm

Greggor wrote:For some reason, the join throttle is just not working... It's set to +j 3:10 and +f [10j#R10,10m#M10,10t#b]
I would be suspicious at the thought that BOTH systems would fail :p.

What is your +f set to though? I'm missing the time parameter (the :xx part) ;).
So not '+f [10j#R10,10m#M10,10t#b]' but like '+f [10j#R10,10m#M10,10t#b]:60'
[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
[6:21pm]Parts: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) (<Insert Racist Message>) «29 users »
[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
(etc..)
Hmm, too bad you don't have seconds in your timestamp though :). Since now it's not any proof :P.

Why not put it at +j 3:40? +j 3:10 seems a bit too nice if you ask me ;)

Greggor
Posts: 8
Joined: Sat Sep 18, 2004 7:07 pm

Re: Join Throttle

Post by Greggor » Fri Oct 07, 2005 12:15 am

Syzop wrote:
Greggor wrote:For some reason, the join throttle is just not working... It's set to +j 3:10 and +f [10j#R10,10m#M10,10t#b]
I would be suspicious at the thought that BOTH systems would fail :p.

What is your +f set to though? I'm missing the time parameter (the :xx part) ;).
So not '+f [10j#R10,10m#M10,10t#b]' but like '+f [10j#R10,10m#M10,10t#b]:60'
Whoops, forgot to add the :15
Syzop wrote:
[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
[6:21pm]Parts: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) (<Insert Racist Message>) «29 users »
[6:21pm]Joins: plz_hav_cex (~ident@Swift-8F66FB71.sympatico.ca) «30 users »
(etc..)
Hmm, too bad you don't have seconds in your timestamp though :). Since now it's not any proof :P.
But I'm not lying :(
Syzop wrote: Why not put it at +j 3:40? +j 3:10 seems a bit too nice if you ask me ;)
Some people don't know how to work their IRC client I guess :S
<Server down for maintenance>

^ :D

Dukat
Posts: 1083
Joined: Tue Mar 16, 2004 5:44 pm
Location: Switzerland

Re: Join Throttle

Post by Dukat » Fri Oct 07, 2005 8:34 am

Greggor wrote:The idiot in question is using proxies and is impossible to ban.
Use a proxy scanner (like BOPM)- that should help.
If you don't make mistakes, you aren't really trying.
- Coleman Hawkins

aquanight
Official supporter
Posts: 862
Joined: Tue Mar 09, 2004 10:47 pm
Location: Boise, ID

Post by aquanight » Sat Oct 08, 2005 4:50 am

Without seconds in timestamps it's impossible to see the exact timing of each join and quit. Since your timeout is set to 10, you need to determine if he is in fact joining more than 3 times within a 10 second period. Without seconds in timestamps... your guess is as good as mine.

Greggor
Posts: 8
Joined: Sat Sep 18, 2004 7:07 pm

Post by Greggor » Sat Oct 08, 2005 6:22 pm

Dukat wrote:Use a proxy scanner (like BOPM)- that should help.
We already use a BOPM and a Tor-detector. It doesn't help at all.
aquanight wrote:Without seconds in timestamps it's impossible to see the exact timing of each join and quit. Since your timeout is set to 10, you need to determine if he is in fact joining more than 3 times within a 10 second period. Without seconds in timestamps... your guess is as good as mine.
He IS joining over 3 times in 10 seconds. I'm there every time it happens. And it happens at least 3 times a day every day. Hell, he's joining over 10 times in 3 seconds.
<Server down for maintenance>

^ :D

White_Magic
Posts: 267
Joined: Tue Jan 18, 2005 3:24 pm
Location: Scotland - United Kingdom

Post by White_Magic » Mon Oct 10, 2005 12:38 pm

if ur so sure hes joining 10times so quickly why not do +j 10:2
this`ll surely stop him
i spend 4 hrs a day gaming and 14hrs on irc, for 5days a week, im not an addict :D

Syzop
UnrealIRCd head coder
Posts: 1957
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Post by Syzop » Mon Oct 10, 2005 3:46 pm

Like I said, 3 days ago.. +j 3:40.
If someone is (re)joining more than 3 times in 40 seconds, I would consider that quite annoying. Also note that it does not ban the user or anything, they just cannot join for x(x) sec again. That should teach them to behave.

+j 3:10 is really too few... You find 1 (re)join every 5s ok then?? aka 12 joins per minute

Greggor
Posts: 8
Joined: Sat Sep 18, 2004 7:07 pm

Post by Greggor » Mon Oct 10, 2005 4:08 pm

Ok, I'll try resetting the join throttle to 3:40
<Server down for maintenance>

^ :D

Solutech
Posts: 296
Joined: Thu Mar 18, 2004 11:38 pm

Post by Solutech » Mon Oct 10, 2005 4:12 pm

Are you sure bopm isnt catching these addys ? . I had a problem with proxies from sympatico and cox and when I installed bopm it klined each connect immediately. Check bopm for error logs on the scans .
Yawn. So there's yet another "if the user clicks the button, they're infected" exploit. Why is this news? We already know users are idiots.

Greggor
Posts: 8
Joined: Sat Sep 18, 2004 7:07 pm

Post by Greggor » Wed Oct 12, 2005 1:37 am

There's absolutely no problem with the bopm... Every once in a while we get a loser try to proxy in... but this guy gets around it every time without exception.
<Server down for maintenance>

^ :D

Solutech
Posts: 296
Joined: Thu Mar 18, 2004 11:38 pm

Post by Solutech » Wed Oct 12, 2005 2:10 am

if you dont get users from sympatico or cox then id suggest glining both hosts . Drastic but it keeps him out . you could always grant an exception to users you know off those providers. Although I havent seen anyone off cox or sympatico that wasnt on proxy yet lol .

In my experience most proxy nerds have only a handful of good proxies the scanners dont catch . They then fall back to the known proxies and bopm takes over from there .
Yawn. So there's yet another "if the user clicks the button, they're infected" exploit. Why is this news? We already know users are idiots.

black_skies4
Posts: 29
Joined: Mon Jun 20, 2005 2:51 pm

Post by black_skies4 » Fri Oct 14, 2005 10:27 pm

No, trust me, we have users from all over the place. SwiftIRC is a big network. Having the join mode too low won't be good either because of the idiots on Swiftswitch pressing the Help button a million times going "WHY ISN'T A HELP SCREEN COMING UP?!!?" which makes them keep joining/parting the help channel.

Trust me and Greggor on this, that idiot does join way more than three times in ten seconds. He is an AOLer, the host that was showing was him proxying.

w00t
Posts: 1136
Joined: Thu Mar 25, 2004 3:31 am
Location: Nowra, Australia

Post by w00t » Sat Oct 15, 2005 6:50 am

I think we can call this closed.. it's really getting nowhere but running around in circles.
-ChatSpike IRC Network [http://www.chatspike.net]
-Denora Stats [http://denora.nomadirc.net]
-Omerta [http://www.barafranca.com]

Locked