This is the new home of the egghelp.org community forum.
All data has been migrated (including user logins/passwords) to a new phpBB version.


For more information, see this announcement post. Click the X in the top right-corner of this box to dismiss this message.

a ban script based on number of ip from same domain

Requests for complete scripts or modifications/fixes for scripts you didn't write. Response not guaranteed, and no thread bumping!
Post Reply
User avatar
SaPrOuZy
Halfop
Posts: 75
Joined: Wed Mar 24, 2004 7:38 am
Location: Lebanon

a ban script based on number of ip from same domain

Post by SaPrOuZy »

Hello there,
it's a small script (and an easy one too) but am not really finding the time (or the mood) to write it..
here the idea:
suppose 10 ip from a domain xy.z.net joined a channel to flood (notice/msg...) they started noticing the chan and started to get banned quickly one after the other..
now what i want to do is ban the domain xy.z.net since i'd consider these hosts to be infected range of ips or something...
so what should be done is couting the bans that are set in a specified period of time, and ban the biggest common part of those addresses
ex:
if the address is in host format:
45-122-211-11.terra.net
45-123-11-21.terra.net
45-122-213-33.terra.net
idealy what should be banned is *!*@45*.terra.net but i think it would be hard so the script should ban *!*@*.terra.net (and remove the others)
if the address is in numeric ip format:
192.168.0.22
192.168.0.56
192.168.0.85
192.168.0.99
we should ban *!*@192.168.0.*

195.10.112.36
195.10.122.12
195.10.141.233
195.10.165.153
we should ban *!*@195.10.1*

this script intends to keep the number of bans limited to a minimum, of course exemptions should be added.

i hope i made it clear enough for you guys...
and thanks in advance if anyone decided to do it
User avatar
Sir_Fz
Revered One
Posts: 3793
Joined: Sun Apr 27, 2003 3:10 pm
Location: Lebanon
Contact:

Post by Sir_Fz »

Code: Select all

proc fixBans c {
 set cbs [chanbans $c]
 foreach cb $cbs {
  set b *!*@[lindex [split [lindex $cb 0] @] 1]
  set mb [maskhost $b]
  set cbs [lreplace $cbs [lsearch -exact $cbs $cb] [lsearch -exact $cbs $cb]]
  foreach cb2 $cbs {
   set b2 *!*@[lindex [split [lindex $cb2 0] @] 1]
   if {[string match -nocase $mb $b2]} {
    lappend gb($mb) [lindex $cb2 0]
    set cbs [lreplace $cbs [lsearch -exact $cbs $cb2] [lsearch -exact $cbs $cb2]]
   }
  }
 }
 foreach {a b} [array get gb] {
  if {[llength $b] > 1} {
   foreach ban $b {
    pushmode $c -b $ban
   }
   pushmode $c +b $a
  }
 }
}
fixBans $chan should do what you asked for but not totally, only bans matching like 127.0.0.* will be removed and replaced by that one or bans like *.fz.net.
User avatar
SaPrOuZy
Halfop
Posts: 75
Joined: Wed Mar 24, 2004 7:38 am
Location: Lebanon

Post by SaPrOuZy »

thx dude, i'll start from here to continue coding the rest of features
- autmating through x bans/ T time
- and get the biggest common part of the ips ...

regards.
User avatar
demond
Revered One
Posts: 3073
Joined: Sat Jun 12, 2004 9:58 am
Location: San Francisco, CA
Contact:

Post by demond »

see my posting in the FAQ forum about CIDR bans

ircd-hybrid supports them, I'd guess ratbox too and maybe ircu (yes qpeople, that's where qnet is coming from)
connection, sharing, dcc problems? click <here>
before asking for scripting help, read <this>
use

Code: Select all

 tag when posting logs, code
Post Reply