Here is my description of how DCC Send works from a previous post.

if DCC is truly direct client to client then how can a network filter out whats being sent via dcc??? ..... excuse me if im butting in on this conversation just a bit curious on how that part of it works exactly??

The same way they can check for anything else. Check for :DCC SEND

From DALnet's bahamut (s_user.c):
Code:

int check_for_ctcp(char *str, char **dccptr)
{
    char       *p = str;
                
    while ((p = strchr(p, 1)) != NULL)
    {
        if (myncmp(++p, "DCC", 3) == 0)
        {
            if (dccptr)
                *dccptr = p;
            if (myncmp(p+3, " SEND", 5) == 0)
                return CTCP_DCCSEND;
            else 
                return CTCP_DCC;

Basically, if the first word is DCC, we know we have a DCC message of some sort coming through the server, if the next word is SEND, we have ourselves a DCC SEND message so we will check it for file extensions in order to allow us to hook in the /DCCALLOW system.cool

Remember, this all happens before the actual DCC transfer takes place. It's the initiating protocol that uses the IRC server to set up the DCC session parameters.