software/RELEASES/ircservices/achurch.org/services/lists/ircservices/2003/003846.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
   2 <HTML>
   3  <HEAD>
   4    <TITLE> [IRCServices] Major fizzer worm problem
   5    </TITLE>
   6    <LINK REL="Index" HREF="index.html" >
   7    <LINK REL="made" HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Major%20fizzer%20worm%20problem&In-Reply-To=">
   8    <META NAME="robots" CONTENT="index,nofollow">
   9    <META http-equiv="Content-Type" content="text/html; charset=us-ascii">
  10    <LINK REL="Previous"  HREF="003845.html">
  11    <LINK REL="Next"  HREF="003840.html">
  12  </HEAD>
  13  <BODY BGCOLOR="#ffffff">
  14    <H1>[IRCServices] Major fizzer worm problem</H1>
  15     <B>Andrew Kempe</B>
  16     <A HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Major%20fizzer%20worm%20problem&In-Reply-To="
  17        TITLE="[IRCServices] Major fizzer worm problem">andrewk at isdial.net
  18        </A><BR>
  19     <I>Thu May 15 01:08:15 PDT 2003</I>
  20     <P><UL>
  21         <LI>Previous message: <A HREF="003845.html">[IRCServices] Major fizzer worm problem
  22 </A></li>
  23         <LI>Next message: <A HREF="003840.html">[IRCServices] Major fizzer worm problem
  24 </A></li>
  25          <LI> <B>Messages sorted by:</B>
  26               <a href="date.html#3846">[ date ]</a>
  27               <a href="thread.html#3846">[ thread ]</a>
  28               <a href="subject.html#3846">[ subject ]</a>
  29               <a href="author.html#3846">[ author ]</a>
  30          </LI>
  31        </UL>
  32     <HR>
  33 <!--beginarticle-->
  34 <PRE>This mail is not aimed at anyone in particular, it just happened to be at
  35 the top of the list for this thread.
  36
  37 Please can we end this thread. It doesn't have very much to do with IRC
  38 Services and there are much better places to discuss it anyway.
  39
  40 Thanks, Andrew
  41
  42 ----- Original Message -----
  43 From: &quot;V13&quot; &lt;<A HREF="http://www.ircservices.za.net/mailman/listinfo/ircservices">v13 at it.teithe.gr</A>&gt;
  44 To: &quot;IRC Services General Mailing List&quot; &lt;<A HREF="http://www.ircservices.za.net/mailman/listinfo/ircservices">ircservices at ircservices.za.net</A>&gt;
  45 Sent: Wednesday, May 14, 2003 8:41 PM
  46 Subject: Re: [IRCServices] Major fizzer worm problem
  47
  48
  49 &gt;<i> On Wednesday 14 May 2003 17:32, Fireman wrote:
  50 </I>&gt;<i> &gt; We are also one of the targets and we had been glining them.  But what
  51 </I>we
  52 &gt;<i> &gt; noticed was that the roughly 7000 glines we had set were causing the cpu
  53 </I>&gt;<i> &gt; processes to run up higher than normal and was actually causing a bigger
  54 </I>&gt;<i> &gt; problem.  What we decided to do was to just stop banning them and see
  55 </I>how
  56 &gt;<i> &gt; things go.  So far we have noticed less cpu usage and less bandwidth
  57 </I>usage.
  58 &gt;<i> &gt; It's basically a &quot;lesser of two evils&quot; approach.
  59 </I>&gt;<i>
  60 </I>&gt;<i> We have patched our services-4 to accept regular expression akills (only
  61 </I>by
  62 &gt;<i> services admins) in the form of:
  63 </I>&gt;<i>
  64 </I>&gt;<i> [+][nick!]<A HREF="http://www.ircservices.za.net/mailman/listinfo/ircservices">userid at hostname</A>[#gecos]
  65 </I>&gt;<i>
  66 </I>&gt;<i> Where + matches a client using an unregistered nickname. When a client
  67 </I>matches
  68 &gt;<i> this regular expression services place a 30 min k-line on his IP (which is
  69 </I>&gt;<i> the same as a zline for bahamut)...
  70 </I>&gt;<i>
  71 </I>&gt;<i> I believe that a feature like this would solve your gline problem if there
  72 </I>is
  73 &gt;<i> any pattern on the bots...
  74 </I>&gt;<i>
  75 </I>&gt;<i> &gt; Fireman
  76 </I>&gt;<i> &lt;&lt;V13&gt;&gt;
  77 </I>&gt;<i>
  78 </I>&gt;<i> ------------------------------------------------------------------
  79 </I>&gt;<i> To unsubscribe or change your subscription options, visit:
  80 </I>&gt;<i> <A HREF="http://www.ircservices.za.net/mailman/listinfo/ircservices">http://www.ircservices.za.net/mailman/listinfo/ircservices</A>
  81 </I>&gt;<i>
  82 </I>&gt;<i>
  83 </I>
  84 </PRE>
  85
  86 <!--endarticle-->
  87     <HR>
  88     <P><UL>
  89         <!--threads-->
  90         <LI>Previous message: <A HREF="003845.html">[IRCServices] Major fizzer worm problem
  91 </A></li>
  92         <LI>Next message: <A HREF="003840.html">[IRCServices] Major fizzer worm problem
  93 </A></li>
  94          <LI> <B>Messages sorted by:</B>
  95               <a href="date.html#3846">[ date ]</a>
  96               <a href="thread.html#3846">[ thread ]</a>
  97               <a href="subject.html#3846">[ subject ]</a>
  98               <a href="author.html#3846">[ author ]</a>
  99          </LI>
 100        </UL>
 101
 102 </body></html>