egghelp.org community

[kerberos]

Hips,

I have ran into quite nasty and irritating problem with my botnet: One of my leaf bots unlinks all other leaf bots.

I have five bots, one hub and other are connected to it. They share userfiles, and that part works fine, share works and so on.

A while ago though one of leafbots decided to take over the world, and unlinked all other leafs from hub. Leafs being set to autoreconnect, it caused quite massive amount of crap into logs.

Below is piece of log which I recorded.
First line tells that userfile transfer has succeed to Fluffy. Last line says Aino denied Fluffy.
Unknown is hub, fluffy is one leaf, and Aino is one misbehaving leaf, who actually causes those unlinks.

[21:56] käyttäjätiedoston siirto onnistunut Fluffy lle.
[21:56] [Fluffy] u Unknown +EDNE
[22:00] [Aino] po
[22:00] [Fluffy] po
[22:00] [Aino] pi
[22:00] [Aino] r Aino Fluffy
[22:00] Aino evätty Fluffy

Earlier after Aino had unlinked some leafbot, Unknown unlinked it with reason Unleaflike behaviour. After I gave botattr +l to Aino, it stays connected. Once in a while Unknown logs shows that Aino does those po / pi lines. No other bot seems to be doing them.

What should I start to do with this issue?

[demond]

as long as Aino stays connected and doesn't misbehave when given +l, you are okay

pi and po are normal botnet ping/pongs, every linked bot issues those to its peer(s)

you might want to recreate Aino's userfile (restart with eggdrop -m)
_________________
connection, sharing, dcc problems? click <here>
before asking for scripting help, read <this>
use [code] tag when posting logs, code

[kerberos]

I figured that pi and po are those, but strange that I only see Aino doing them.

Anyway, giving Aino +l didn't remove this issue, it just changed it a bit.

Before Aino had +l, Unknown unlinked it after Aino unlinked other bot.

After I set +l to Aino in Unknown, Aino unlinks other bots, but Unknown doesn't do anything.

I thought re-creating userfile, but then I would need to shutdown whole bot for that. And it has served so nicely this far, this problem has just arised, and I thought there might be some other way to fix things.

[demond]

then unlink it from the hub, -bot all bots, readd the hub, relink

also, if you were using rconsole, you would have seen those ping/pongs bouncing throughout your entire botnet
_________________
connection, sharing, dcc problems? click <here>
before asking for scripting help, read <this>
use [code] tag when posting logs, code