mIRC Home    About    Download    Register    News    Help

Print Thread
Joined: Jan 2004
Posts: 46
F
Ameglian cow
OP Offline
Ameglian cow
F
Joined: Jan 2004
Posts: 46
Hello;

Ok, I'm trying to fix a problem on our Network, which is not the usual bot-flooding, but instead it is with clone sets. So what I'm after is a script that doesn't kick/ban by text or join flood, but rather based on number of clone-sets that joins in a given time-frame. I've searched through the archives a bit, and of course found many clone scripts/detectors, but not this combination I'm after. I can add the reaction level myself if that helps anyone figure this out easier.

Any help would be greatly appreciated. Thanks.

Joined: Jan 2004
Posts: 46
F
Ameglian cow
OP Offline
Ameglian cow
F
Joined: Jan 2004
Posts: 46
Alright, did I actually make this sound harder than it really is? lol

In other words, what I'm trying to do is this: When say, 7 (or more) nicks have joined that end up being clones, in a given timeframe, kick/ban or kill the nicks by address. I'll use the -u flag to return everything to normal after 'another' timeframe. Does that make this any easier to respond to? I hope so, and sorry for the confusion or vagueness. Thanks.

Joined: Oct 2005
Posts: 1,741
G
Hoopy frood
Offline
Hoopy frood
G
Joined: Oct 2005
Posts: 1,741
In order to make this work, you will need to check each user's hostmask when they join and then store than data somewhere (probably a hash table), and then when there are enough users from a certain host, some action can be taken. You need to decide what your criteria are for considering a group of people to be clones? Do they all have to have identical [email]ident@host.masks[/email], or similar nicknames (nick12345, nick23456, etc), or identical *@*wild.host.masks ?

-genius_at_work

Joined: Jan 2004
Posts: 46
F
Ameglian cow
OP Offline
Ameglian cow
F
Joined: Jan 2004
Posts: 46
Ok. Again, I'll try to get this explanation right, so all of you great script helpers out there, can help me with this one.

I have this script, which does work just fine for clone-detection, then kicking:
Code:
 on @*:JOIN:#:{
  if ($ial == $false) .ial on
  if ($chan(#).ial == $false) { who # | return }
  var %total = $ialchan($wildsite,#,0)
  if (%total > 1) {
    ban -u60 # $nick 2
    var %i = 0
    while (%i < %total) {
      inc %i
      var %nick = $ialchan($wildsite,#,%i).nick     
      var %all.nicks = $addtok(%all.nicks,%nick,32)    
      if (%nick !isop #) {
        kick # %nick Clone flood detected from $wildsite ( $+ %total users)
      }
    }
    echo 14 -a Clone flood detected from $wildsite $+ : %all.nicks
  }
}   


What I'm trying to do, is use a basic code much like the above, yet instead of kicking a single clone(s) when the clonee joins, instead what I want to do, is wait or cache or whatever, the kicking/banning until approx. 6 clones or more have joined in a given timeframe, for example 20-30 secs. If that should happen, then kick/ban the offending 6 clones. It doesnt have to be both offenders of the cloneset, like that script will do, even just the joiner that creates a cloneset will work for me. The problem area for me to figure out, is how to go back to k/b those cached clonesets. I don't want to take action on just the 1 or 2 occaisional clones, but more so, the beginning of a serious problem, which 1 or 2 is not. See what I mean?

To try to answer the question about how they would be clone-detected, it will not be by nick at all, but by hostmask, so it looks like the third one you listed would be the choice for me.

I hope this is finally clear enough to someone, so that they can help me slowly fill in the blanks here. Thanks.


Link Copied to Clipboard