Previous Next Table of Contents

3. Channel Guard System

3.1 Flood in general

What is flooding

From the Hacker's Dictionary (aka. Jargon file)

:flood: v. [IRC] To dump large amounts of text onto an {IRC} channel. This is especially rude when the text is uninteresting and the other users are trying to carry on a serious conversation. Flooding can also be done with all sorts of messages.

Generally, doing anything too much too fast is called 'to flood'. When an IRC client receives a querying message, it answers it. If the client answers too rapidly the IRC server closes connection to the client. Thus, if a lot of bots ask a single client or publicly asking all clients in a channel lots of times within a short period, all the clients that reply to the questions will get cut off from their servers.

Server flood control

[TECH TALK DETECTED] The server holds a few variables that directly concern us. The first and most important is the 'since'. It always holds the time of our last package sent to the server. At least. When our package is processed, the 'since' variable gets increased with the 'penalty' value of the particular command we use. (1-3 is normal, but 5 and higher is far from hard to achieve.)

Incoming packages to the server are only processed if 'since' is less than 10 seconds ahead of the current time. If it isn't, the message will remain in the queue. If the queue size gets bigger than 1000 bytes (by default, may vary in different servers), the client is cut off ("Excess Flood").

Evidently, you can use a command with a very high penalty value (i.e "KICK #channel nick1,nick2,nick3,nick4,nick5,nick6 :go home") without suffering, but with such a high penalty (2*nick + default sums up around 15) your input queue in the server won't get read within the following 5 seconds and thus any command sent to the server in the meantime are simply taking you closer to the edge.

Different flood attacks

The ways of the flooders are unpredictable. Most flooders use some kind of script or program they download from somewhere. The internet drowns in offensive programs and scripts. Floods can and are done with one or many clients/bots/programs. And of course all the types below can be mixed in any way.

Standard message flood

Paste lots of text in a channel. The most common case, some loser repeats the same line with offensive language a large number of times. Reason is to confuse (or simply annoy) other users.

Nick flood

Keep changing nick in the channel very fast. Reason is to

CTCP flood

Send lots of various CTCP messages to users and/or to channel. The purpose of ctcp is to handle automated requests. Hence a ctcp request to a user, is automatically replied by the client of that user. By sending lots of requests, a lot of replies will be generated resulting in an Excess Flood of the replying user.

3.2 Dancer defences

Warning on join

Users that join the channel and match a pattern stored in the WARNLIST makes the bot make a public

<robot> ALERTS: <nick> is <description>
The description is stored together with the userpattern in the WARNLIST. When a warning has been issued, the same warning won't show the following hour.


Users in the WARNLIST can be marked as [KICKBANNED] which will make Dancer kick and ban the user on join. The matching pattern from the WARNLIST will be used as banpattern as well. The delay that standard warnings have is not affecting this kind of warnings.

Warning at 18 bans

The regular IRC networks only allows 20 bans in a single channel. Dancer presents an ALERT message when the amount of bans reaches 18 to make the users aware of the problem. Since version 4.0 (beta 3), Dancer is capable of removing the least important ban instead of making the alert. This, if the autounban switch is enabled.

Ban on multiple kicks

If a user has been kicked off the channel X times within Y seconds, Dancer puts a ban on him/her. Bot kicks and kicks by users with high status level are considered more important and enforce a ban earlier. 'Intended' kicks that Dancer tries or wants to perform but doesn't succeed with, due to lag or nick change, are also counted.

Trying sitebans

If a ban due to multiple kicks is about to get set, and ONE ban already is set on the same site, Dancer will unban the previous ban and ban their whole site. If there is MORE THAN ONE ban already set on that site, just another userban is set. No matter what ban is set, all users currently joined from that site is marked to get kicked

Undoing server modes

During a netsplit users can gain ops, set bans, change channel modes, etc. When the servers heal again, the split server will set the new modes in the healed channel. Dancer undoes all server bans and channel modes. All users that are opped by the server are carefully checked against the userlist and those who weren't opped before the split and are unknown to the bot, are deopped.

Flood kick

Dancer checks and discovers all sorts of floods. Unrecognized users are kicked instantly when a flood is triggered. Known, low-level users get 3 warnings before getting kicked. High-level users are left alone.

Ban flooders

The 'Ban On Multiple Kicks' makes Dancer ban frequent flooders.

Ignoring floods

Floods that are dangerous to the bot are ignored. Anything more frequent than normal usage allows will enable the ignore mode.

Kick queue

Dancer never kicks many users too fast since that would flood it off its server. It marks all users that are supposed to get kicked and kicks them one after another fast enough to remain connected. It doesn't matter if the user changes nick, since the KICK-mark follows to the new nick. If a user marked for KICK is kicked by another user before the bot does it, Dancer will not attempt to kick it.

Kick banned users

The really big flood attacks are done with a large number of bots joining the channel. Dancer can be set to KICK any user that joins with more than 3 clients with the same hostpattern. This makes Dancer start acting earlier and thus being able to clean off the attackers quicker.

3.3 Help Dancer help you

A few minor things you can do to improve Dancer's capabilities of keeping your channel a fun place to be in.

Previous Next Table of Contents