software/RELEASES/ircservices/achurch.org/services/lists/ircservices/2003/003845.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
   2 <HTML>
   3  <HEAD>
   4    <TITLE> [IRCServices] Major fizzer worm problem
   5    </TITLE>
   6    <LINK REL="Index" HREF="index.html" >
   7    <LINK REL="made" HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Major%20fizzer%20worm%20problem&In-Reply-To=000701c31a25%24a8fc1230%24bea55641%40fireman">
   8    <META NAME="robots" CONTENT="index,nofollow">
   9    <META http-equiv="Content-Type" content="text/html; charset=us-ascii">
  10    <LINK REL="Previous"  HREF="003838.html">
  11    <LINK REL="Next"  HREF="003846.html">
  12  </HEAD>
  13  <BODY BGCOLOR="#ffffff">
  14    <H1>[IRCServices] Major fizzer worm problem</H1>
  15     <B>V13</B>
  16     <A HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Major%20fizzer%20worm%20problem&In-Reply-To=000701c31a25%24a8fc1230%24bea55641%40fireman"
  17        TITLE="[IRCServices] Major fizzer worm problem">v13 at it.teithe.gr
  18        </A><BR>
  19     <I>Wed May 14 12:41:04 PDT 2003</I>
  20     <P><UL>
  21         <LI>Previous message: <A HREF="003838.html">[IRCServices] Major fizzer worm problem
  22 </A></li>
  23         <LI>Next message: <A HREF="003846.html">[IRCServices] Major fizzer worm problem
  24 </A></li>
  25          <LI> <B>Messages sorted by:</B>
  26               <a href="date.html#3845">[ date ]</a>
  27               <a href="thread.html#3845">[ thread ]</a>
  28               <a href="subject.html#3845">[ subject ]</a>
  29               <a href="author.html#3845">[ author ]</a>
  30          </LI>
  31        </UL>
  32     <HR>
  33 <!--beginarticle-->
  34 <PRE>On Wednesday 14 May 2003 17:32, Fireman wrote:
  35 &gt;<i> We are also one of the targets and we had been glining them.  But what we
  36 </I>&gt;<i> noticed was that the roughly 7000 glines we had set were causing the cpu
  37 </I>&gt;<i> processes to run up higher than normal and was actually causing a bigger
  38 </I>&gt;<i> problem.  What we decided to do was to just stop banning them and see how
  39 </I>&gt;<i> things go.  So far we have noticed less cpu usage and less bandwidth usage.
  40 </I>&gt;<i> It's basically a &quot;lesser of two evils&quot; approach.
  41 </I>
  42 We have patched our services-4 to accept regular expression akills (only by
  43 services admins) in the form of:
  44
  45 [+][nick!]<A HREF="http://www.ircservices.za.net/mailman/listinfo/ircservices">userid at hostname</A>[#gecos]
  46
  47 Where + matches a client using an unregistered nickname. When a client matches
  48 this regular expression services place a 30 min k-line on his IP (which is
  49 the same as a zline for bahamut)...
  50
  51 I believe that a feature like this would solve your gline problem if there is
  52 any pattern on the bots...
  53
  54 &gt;<i> Fireman
  55 </I>&lt;&lt;V13&gt;&gt;
  56
  57 </PRE>
  58
  59 <!--endarticle-->
  60     <HR>
  61     <P><UL>
  62         <!--threads-->
  63         <LI>Previous message: <A HREF="003838.html">[IRCServices] Major fizzer worm problem
  64 </A></li>
  65         <LI>Next message: <A HREF="003846.html">[IRCServices] Major fizzer worm problem
  66 </A></li>
  67          <LI> <B>Messages sorted by:</B>
  68               <a href="date.html#3845">[ date ]</a>
  69               <a href="thread.html#3845">[ thread ]</a>
  70               <a href="subject.html#3845">[ subject ]</a>
  71               <a href="author.html#3845">[ author ]</a>
  72          </LI>
  73        </UL>
  74
  75 </body></html>