Here is
my description of how DCC Send works from a previous post.
if DCC is truly direct client to client then how can a network filter out whats being sent via dcc??? ..... excuse me if im butting in on this conversation just a bit curious on how that part of it works exactly??The same way they can check for anything else. Check for :DCC SEND
From DALnet's bahamut (s_user.c):
int check_for_ctcp(char *str, char **dccptr)
{
char *p = str;
while ((p = strchr(p, 1)) != NULL)
{
if (myncmp(++p, "DCC", 3) == 0)
{
if (dccptr)
*dccptr = p;
if (myncmp(p+3, " SEND", 5) == 0)
return CTCP_DCCSEND;
else
return CTCP_DCC;
Basically, if the first word is DCC, we know we have a DCC message of some sort coming through the server, if the next word is SEND, we have ourselves a DCC SEND message so we will check it for file extensions in order to allow us to hook in the /DCCALLOW system.

Remember, this all happens before the actual DCC transfer takes place. It's the initiating protocol that uses the IRC server to set up the DCC session parameters.