Join / Part flood kills my botnet

Satras · Post by **Satras** » Mon May 02, 2005 6:20 am

Some guys dont like my botnet, so they kill it by join/part flood

i allready got 4:30 .. but set it to 2:60 now.

Any idea what else i can do ?

[11:58am] [mob\] 84s
[11:58am] »» voice |Sabrina| voices silkk in #futuregrooves
[11:58am] [mob\] hm
[11:58am] [silkk] bitches
[11:58am] [mob\] heh
[11:58am] [silkk] :P
[11:58am] [mob\] sabrina
[11:58am] [mob\] whois her
[11:58am] [mob\] same thang
[11:58am] »» join helldjj (hyojin@cust-179-15.dsl.versateladsl.be) [Belgium]
[11:58am] «« part helldjj [hyojin@cust-179-15.dsl.versateladsl.be]
[11:58am] »» join helldjj (hyojin@cust-179-15.dsl.versateladsl.be) [Belgium]
[11:58am] «« part helldjj [hyojin@cust-179-15.dsl.versateladsl.be]
[11:58am] »» join helldjj (hyojin@cust-179-15.dsl.versateladsl.be) [Belgium]
[11:58am] »» join [escape] (opio@cm-24-121-67-120.stjoseph.mo.npgco.com) [Internic Commercial]
[11:58am] «« part [escape] [opio@cm-24-121-67-120.stjoseph.mo.npgco.com]
[11:58am] »» join aviance (~Guest6755@24.80.196.42) [Unknown]
[11:58am] «« part aviance [~Guest6755@24.80.196.42]
[11:58am] »» join aviance (~Guest6755@24.80.196.42) [Unknown]
[11:58am] »» join [escape] (opio@cm-24-121-67-120.stjoseph.mo.npgco.com) [Internic Commercial]
[11:59am] «« part [escape] [opio@cm-24-121-67-120.stjoseph.mo.npgco.com]
[11:59am] »» join [escape] (opio@cm-24-121-67-120.stjoseph.mo.npgco.com) [Internic Commercial]
[11:59am] «« part [escape] [opio@cm-24-121-67-120.stjoseph.mo.npgco.com]
[11:59am] »» join [escape] (opio@cm-24-121-67-120.stjoseph.mo.npgco.com) [Internic Commercial]
[11:59am] «« part aviance [~Guest6755@24.80.196.42]
[11:59am] »» join aviance (~Guest6755@24.80.196.42) [Unknown]
[11:59am] «« part aviance [~Guest6755@24.80.196.42]
[11:59am] »» join aviance (~Guest6755@24.80.196.42) [Unknown]
[11:59am] »» join eugenia (azbar@HSE-Toronto-ppp3484649.sympatico.ca) [Canada]
[11:59am] «« part eugenia [azbar@HSE-Toronto-ppp3484649.sympatico.ca]
[11:59am] »» join kingoflov (~none@port100.conagri.net) [Internic Network]
[11:59am] »» join eugenia (azbar@HSE-Toronto-ppp3484649.sympatico.ca) [Canada]
[11:59am] «« part eugenia [azbar@HSE-Toronto-ppp3484649.sympatico.ca]
[11:59am] »» join eugenia (azbar@HSE-Toronto-ppp3484649.sympatico.ca) [Canada]
[11:59am] «« part kingoflov [~none@port100.conagri.net]
[11:59am] »» join marialena (velf4@220.117.72.147) [Unknown]
[11:59am] «« part marialena [velf4@220.117.72.147]
[12:00pm] »» join britanie (elainie@211.174.84.34) [Unknown]
[12:00pm] «« part britanie [elainie@211.174.84.34]
[12:00pm] »» join crazY-boY (~deon@222-153-20-15.jetstream.xtra.co.nz) [New Zealand]
[12:00pm] «« part crazY-boY [~deon@222-153-20-15.jetstream.xtra.co.nz]
[12:00pm] »» join kingoflov (~none@port100.conagri.net) [Internic Network]
[12:00pm] «« part kingoflov [~none@port100.conagri.net]
[12:00pm] »» join kingoflov (~none@port100.conagri.net) [Internic Network]
[12:00pm] »» join marialena (velf4@220.117.72.147) [Unknown]
[12:04pm] »» nick change mob\ (mob@hacked.xboxdash.net) changes nick to "illusion"
[12:04pm] «« quit Illusionn [illusionn@d0m4in.de] ( changing servers )
[12:05pm] »» nick change illusion (mob@hacked.xboxdash.net) changes nick to "Ilusion"

Satras · Post by **Satras** » Mon May 02, 2005 7:57 am

Is there any skript that bans peeps wich join and part directly <10 s ?

^DooM^ · Post by **^DooM^** » Mon May 02, 2005 10:58 am

Click Me

Satras · Post by **Satras** » Mon May 02, 2005 11:57 am

^DooM^ wrote:Click Me

thanx a lot man ...

Satras · Post by **Satras** » Tue May 03, 2005 3:36 am

one more thing... they killed it via ident flood and join part flood

caused me 15 GB Traffic in 10 Minutes :S

De Kus · Post by **De Kus** » Tue May 03, 2005 4:35 am

arent you running sentinel.tcl? it should set the channel +i in such cases.

Satras · Post by **Satras** » Tue May 03, 2005 12:23 pm

nope

had some problems with it

the boitnet just freaked out.. i thought the flood-join option will handel such a attack. I also had an chanel limit (+5) set. But it all didnt worked.

^DooM^ · Post by **^DooM^** » Tue May 03, 2005 6:06 pm

Check your Private Message Satras.

De Kus · Post by **De Kus** » Tue May 03, 2005 7:25 pm

Satras wrote:nope had some problems with it

the boitnet just freaked out.. i thought the flood-join option will handel such a attack. I also had an chanel limit (+5) set. But it all didnt worked.

the problem is, that the internal join flood will only trigger on 1 ip. sentinel will also trigger on common floods and set the channel +i and the ban them, if neccessary on the main domain level like *.xy.com, *.xyz.org etc, so it will be more hard to get the banlist full with a common botnet.
the new sentinel version even allows you to specify to set a chan mode for registred user only (most flooders use non registred nicks, but most welcome chatters use registred ones ^^).

you could of course go and copy the join bind only out of the script. you would just need to set the required global vars ^-^. hmmm, no, you would need these unset timed procs, as well ^-^.

Satras · Post by **Satras** » Thu May 05, 2005 3:13 pm

^DooM^ wrote:Check your Private Message Satras.

thanx i come back to you later.. im just arriving from my trip from Uk...

will check everything tomorrow !

Satras · Post by **Satras** » Sat May 07, 2005 9:03 am

The main Problem is, im "working" in EFNEt wich dont allow any registering.
That was the reason why i had this attack..

i think i got everything fixed...

thanx for your help