Another Flood Bot Prevention Discussion

[effect]

wait u said squelching is by there IP so if we are able to squelch the flood bot in time will it all together filter it or is a user who logs on to b.net with the ip squelched from before not squelched by the user who squelched them...lol

And can anyone please respond to my post about clumped join/leave packets above.

Is it just me or does everything you say not make sense ?

ill TRY and answer your question anyways , once you squelch a user he is then squelched on every account he logs on to coming from that IP , however masking yourself with a proxy will avoid this.

Also asking for people to respond to your question will undoubtable make people inturn avoid it and make you look extremly annoying.

[Networks]

even if he logs back on will he still be squelched?

and if masked by a proxy couldn't that IP just squelched if the bot is able thus filitring floods w/ ease.

[Soul Taker]

even if he logs back on will he still be squelched?

and if masked by a proxy couldn't that IP just squelched if the bot is able thus filitring floods w/ ease.

Yes, but you can't squelch an account when it's offline.

[effect]

Yes if you have squelched him and he logs off then on again he will still be squelched (even with a new name) , up until YOU log off.

think of it as , not squelching a SINGLE user but more as squelching ALL users with that certain IP.


<edit>Sorry posted same time</edit>

[Lenny]

wait u said squelching is by there IP so if we are able to squelch the flood bot in time will it all together filter it or is a user who logs on to b.net with the ip squelched from before not squelched by the user who squelched them...lol

And can anyone please respond to my post about clumped join/leave packets above.

Most bots have their data arrival function able to separate clumpted packets....
It's not very difficult, considering bnet gives you the length of the packet.

[UserLoser.]

Two steps on preventing any kind of bots:

1) Get a clan channel
2) Type '/clan private'

[Imperceptus]

even if he logs back on will he still be squelched?

and if masked by a proxy couldn't that IP just squelched if the bot is able thus filitring floods w/ ease.

Yes, but you can't squelch an account when it's offline.

Can always code a local squelch.

[Grok]

Two steps on preventing any kind of bots:

1) Get a clan channel
2) Type '/clan private'

Worthless post of the day.

[UserLoser.]

Two steps on preventing any kind of bots:

1) Get a clan channel
2) Type '/clan private'

Worthless post of the day.

Your momma

It's true though...even though my client has delayed ~425ms for each user on joins for a couple months now

[Networks]

Well then squelching is the best way to go I suppose rather than having to ban 90+ to finally kill all the guys keys and accounts...

[Kp]

Well then squelching is the best way to go I suppose rather than having to ban 90+ to finally kill all the guys keys and accounts...

No, filtering them automatically by analysis of their behavior is much better than squelching.  It avoids bloating your list if they morph names rapidly, and it's much more reliable than server-side squelches.

[Hamtaro]

wouldnt there be ways to make floodbots leave before u got a chance to ban them?  no matter the way you came about catching them.. (squelch, behavior, etc..)

[PaiD]

Hamtaro,
   If the bot filters it then there is nothing the floodbot can do. The filter wouldnt stop it from flooding the channel but all chat events would be sent to the bot/client and it is up to it to do something with it.

Edited: Typos

[Eric]

I think that we've all gotten a little dumber by reading these posts.

Conclusion:
- Filter the floodbots by delaying chat input, ignoring multiple EID_TALK's, EID_EMOTE's, EID_JOIN's and EID_LEAVE's that occur in a single datastream or filter any EID_TALK's, EID_EMOTE's, EID_JOIN's and EID_LEAVE's that take place in under a second of the user joining.
- Squelch the user flooding (providing he isn't using proxies)
- A clan channel and /clan private

The following require two things (considering the floodbot is working at proper speed): A super-computer and an unshared OC-13 line.

- Squelch the floodbots
- Ban the floodbots

[Lenny]

I think that we've all gotten a little dumber by reading these posts.

Conclusion:
- Filter the floodbots by delaying chat input, ignoring multiple EID_TALK's, EID_EMOTE's, EID_JOIN's and EID_LEAVE's that occur in a single datastream or filter any EID_TALK's, EID_EMOTE's, EID_JOIN's and EID_LEAVE's that take place in under a second of the user joining.
- Squelch the user flooding (providing he isn't using proxies)
- A clan channel and /clan private

The following require two things (considering the floodbot is working at proper speed): A super-computer and an unshared OC-13 line.

- Squelch the floodbots
- Ban the floodbots

Personally, to me the most practical solution would be to ignore clumpted EID_TALK's, EID_EMOTE's, EID_JOIN's and EID_LEAVE rather than delaying the chat input to the user.