Page 1 of 1
unknown connection flood not working properly
Posted: Tue Jul 28, 2009 12:56 pm
by glitch
heres my issue. motherless.com has a page setup that redirects all HTTP post data to my server..
wich floods my ocnnection port and maxes my connections.. i have tried several times to setup the unknown-flood line
none of it works properly.. i've even gone as far as ot set it to trigger on 1kb of text.. nothing works..
what the hell should i do? lol
i can't just sit all day typing /close every 30 seconds
Re: unknown connection flood not working properly
Posted: Wed Jul 29, 2009 10:03 pm
by Stealth
I posted 2 replies on the bug tracker about this.
When a browser connects to a website, they do not send much at all. IIRC they send HTTP protocol version, browser version, domain connecting to, and page requested (with POST information if redirected from a form).
If there are so many hits on this page that it is filling your unknown connections, the immediately closing the connection may only be a temporary solution.
You need to find the websites doing this and send their hosts abuse department an email. Most sites used in such a way are on free hosts and this is definitely a violation of their TOS.
> i also suggest only giving clients 10 seconds auth before killing them for failure ot register.
You can configure this in include/config.h. Change the value for CONNECTTIMEOUT, but be sure to read the comment above it and choose a value carefully. Once change, re-run make and if needed make install. Restart your IRCd and the new timeout value will be used.
Have you bothered trying any of these or looking into it? Whining about it won't get anywhere, you need to take more action than just complaining to us repeatedly.
Re: unknown connection flood not working properly
Posted: Thu Jul 30, 2009 12:24 am
by Jobe
One method adopted by ircu to combat this sort of an attack is, pre-registration (NOT NickServ registration) is to treat POST == QUIT and close the connection. I'd assume it could be implimented as a module, but could also be implimented in the core too.