deflood

[BoJlk]

Great, i didn't know about that option
what is it for...?
BTW: is it better to kick or Disconnect users?

[plop]

Originally posted by BoJlk
Great, i didn't know about that option
what is it for...?
BTW: is it better to kick or Disconnect users?

the way deflood is shipped it does what i think is best, a tempban.

plop

[BoJlk]

Got flooded 10 minutes ago...
why Deflood didn't worked?

*Ptokax Error:


from the PtokaX v0.330 build15.25\scripts\logs\iplogs
01/14/05 14:29:15 User GAS88 enters the Hub with IP: 193.165.75.153

[blackwings]

well, Bjolk, I don't think its a bug, because new flooders are made all the time :P

[plop]

Originally posted by BoJlk
Got flooded 10 minutes ago...
why Deflood didn't worked?

*Ptokax Error:


from the PtokaX v0.330 build15.25\scripts\logs\iplogs
01/14/05 14:29:15 User GAS88 enters the Hub with IP: 193.165.75.153

switch 2 15.18 and it won't happen again.
tis is a exploit in 15.25, only deflood 5.0 protects against this.

plop

[BoJlk]

Well, i can't do anything against the DOS attacks like this
only restart the HUB, and i know that the Error come because of the attack!

Anyway i hope my post will help for future exidents  

/edit

I don't seem to be able to resolve the

code:

    Private message from Deflood: *************** - time banned for a wrong ip in the $ConnectToMe, but this could be a hub flooder!! (bad/fake ConnectToMe)

Messages...

I don't know why but, they keep reconnecting every 3 minutes or so, regarding the seetings i've tryied (Disconnect/Kick/tempban/timeban)

[plop]

Originally posted by BoJlk
I don't seem to be able to resolve the

code:

    Private message from Deflood: *************** - time banned for a wrong ip in the $ConnectToMe, but this could be a hub flooder!! (bad/fake ConnectToMe)

Messages...

I don't know why but, they keep reconnecting every 3 minutes or so, regarding the seetings i've tryied (Disconnect/Kick/tempban/timeban)

meet dc++'s auto reconnect.
there are some bugs in the ban handling which cause the re-entry, but a tempban of more then 10 mins should be enough 2 get them out for a while.

plop

[pHaTTy]

Originally posted by plop

Originally posted by BoJlk
Got flooded 10 minutes ago...
why Deflood didn't worked?

*Ptokax Error:


from the PtokaX v0.330 build15.25\scripts\logs\iplogs
01/14/05 14:29:15 User GAS88 enters the Hub with IP: 193.165.75.153

switch 2 15.18 and it won't happen again.
tis is a exploit in 15.25, only deflood 5.0 protects against this.

plop

this prob was of a ptokax threading error, its easily resolved, by anyone deflood that stops multiple attacks, ie userlist flood, and chat flood

-/pha

[imby]

Hi plop, just had my hub flooded. I was using deflood4.5.4.lua and it failed me.

[2005-02-03 21:55]  [Sxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  BMxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  dexxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  Dixxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  imxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  Luxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  Obxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  Skxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  (Cxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  (Nxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  (pxxxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  (pxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  (pxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [1xxxxxxxt [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [56xxxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  []xxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [axxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Bxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Bxxxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Bxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Bxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Cxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Cxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Fxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [fxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Hxxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Hxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Mxxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Nxxxxxxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Nxxxxxx [URL]www.ochyda.abc.pl[/URL]
[2005-02-03 21:55]  [Pxxxxxxxxx [URL]www.ochyda.abc.pl[/URL]

and it went on through the nicklist I'd say another 1000 times in two minutes. At a rate of about 25 messages per sec according to the logs. After which an op manually banned the user. (I only showed the first two charectors of each nick to protect the users privacy.)

How come deflood didn't catch this? deflood doesn't work off how many times a user can post in a interval, and only catches users who post the exact same message?

[plop]

Originally posted by imby
Hi plop, just had my hub flooded. I was using deflood4.5.4.lua and it failed me.

How come deflood didn't catch this? deflood doesn't work off how many times a user can post in a interval, and only catches users who post the exact same message?

you found the main difference between deflood 4 and 5.
just came up with 1 more feature i wanna add 2 deflood 5, but a public beta is really close.

plop

[imby]

thanks, so you're saying this is already added, or you're about to add it? Anyway, if you think public beta will be released within a week, I may aswell wait, if not, feel free to email me it.

[plop]

Originally posted by imby
thanks, so you're saying this is already added, or you're about to add it? Anyway, if you think public beta will be released within a week, I may aswell wait, if not, feel free to email me it.

deflood 5 is a complete rewritten version, using totaly different routines.
instead of detecting flooders by behaviour or looks it detects the difference between a user and a program.

@ imby: check your pm.

plop

[QuikThinker]

I've recently changed the min shares etc needed to get in my main hub and redirect the excess users to my other hub. However I now have excessive deflood alerts and dunno why:

[16:33:32] Private message from ?Q??KPR?T?KT?: hollahollaholla - 62.145.183.64 - 02/16/05 16:35:29 - banned for using a hub flooder!! (GetNickList flood)
[16:35:22] Private message from ?Q??KPR?T?KT?: Paul_Kemp - 84.217.94.60 - 02/16/05 16:37:19 - banned for using a hub flooder!! (GetNickList flood)
[16:36:01] Private message from ?Q??KPR?T?KT?: hgfderqfd - 82.228.156.88 - 02/16/05 16:37:59 - banned for using a hub flooder!! (GetNickList flood)
[16:38:30] Private message from ?Q??KPR?T?KT?: Carbon - 85.164.245.189 - 02/16/05 16:40:27 - banned for using a hub flooder!! (GetNickList flood)
[16:38:30] Private message from ?Q??KPR?T?KT?: apneist321 - 82.35.80.138 - 02/16/05 16:40:29 - banned for using a hub flooder!! (GetNickList flood)
[16:38:32] Private message from ?Q??KPR?T?KT?: hisssaa(8Mbit/s) - 81.229.240.217 - 02/16/05 16:40:30 - banned for using a hub flooder!! (GetNickList flood)
[16:38:39] Private message from ?Q??KPR?T?KT?: [Gis][Ele] - 83.116.140.239 - 02/16/05 16:40:37 - banned for using a hub flooder!! (GetNickList flood)
[16:39:38] Private message from ?Q??KPR?T?KT?: (los)dai - 217.44.47.226 - 02/16/05 16:41:38 - banned for using a hub flooder!! (GetNickList flood)
[16:40:24] Private message from ?Q??KPR?T?KT?:  - 62.111.174.1 - 02/16/05 16:42:23 - banned for using a hub flooder!! (banned on nickname)
[16:40:30] Private message from ?Q??KPR?T?KT?: [10Mbit]Mira - 217.78.17.9 - 02/16/05 16:42:29 - banned for using a hub flooder!! (GetNickList flood)
[16:41:06] Private message from ?Q??KPR?T?KT?: farshad - 80.0.150.57 - 02/16/05 16:43:06 - banned for using a hub flooder!! (GetNickList flood)
[16:46:06] Private message from ?Q??KPR?T?KT?: [PG]-Kyle - 172.200.217.36 - 02/16/05 16:48:09 - banned for using a hub flooder!! (GetNickList flood)
[16:47:06] Private message from ?Q??KPR?T?KT?: DD - 83.226.109.230 - 02/16/05 16:49:09 - banned for using a hub flooder!! (GetNickList flood)
[16:47:27] Private message from ?Q??KPR?T?KT?: (NL)SuperSkillz(128k) - 84.24.6.218 - 02/16/05 16:49:30 - banned for using a hub flooder!! (GetNickList flood)

All for the same reason aswell. Is there anythin in the config I can adjust?

[blackwings]

Originally posted by QuikThinker
I've recently changed the min shares etc needed to get in my main hub and redirect the excess users to my other hub. However I now have excessive deflood alerts and dunno why:

All for the same reason aswell. Is there anythin in the config I can adjust?

What is you setting on "iMaxGetNick"?

And did you before you made the change with the min share and the redirect thingie tell the users about it through mass messages? if you didn't tell the users before you made the changes, then some users might think somthing is wrong and update the user list = GetNickList flood

[QuikThinker]

----------------------------------------------------------------------
---- max amount of times someone can do $GetNickList before deflood treads it as a flooder.
iMaxGetNick = 5
----------------------------------------------------------------------

And they automatically get redirected b4 they enter my main hub.

[plop]

Originally posted by QuikThinker
----------------------------------------------------------------------
---- max amount of times someone can do $GetNickList before deflood treads it as a flooder.
iMaxGetNick = 5
----------------------------------------------------------------------

And they automatically get redirected b4 they enter my main hub.

also check iFlushTime.
on default it's set to 10 seconds, and because of this it's the users own fault deflood kicks them.
requesting a fresh nicklist for 5 times within 10 seconds is pointless.
or maby your hub has a huge lag and they wonder that it might not work.

plop

[QuikThinker]

I also got this 2day that I aint ever seen since usin deflood:
[14:49:45] Private message from ?Q??KPR?T?KT?: *** [PHH]-musicalartists - ( 206.28.64.226 ) from Company ( American Guild of Musical Artists AP2P ) tried to login! ***

[plop]

Originally posted by QuikThinker
I also got this 2day that I aint ever seen since usin deflood:
[14:49:45] Private message from ?Q??KPR?T?KT?: *** [PHH]-musicalartists - ( 206.28.64.226 ) from Company ( American Guild of Musical Artists AP2P ) tried to login! ***

the only thing i can tell you is that it didn't come from deflood.

plop

[plop]

got a new toy on my website, deflood 5.0 rc:1.

plop

[blackwings]

Originally posted by plop
got a new toy on my website, deflood 5.0 rc:1.

plop

so all the comming releases of deflood 5.0 will now be public?

[TecMaster]

Nice plop and goooooooooooood work

[plop]

Originally posted by blackwings

Originally posted by plop
got a new toy on my website, deflood 5.0 rc:1.

plop

so all the comming releases of deflood 5.0 will now be public?

if the name hasn't got alpha in the name it's a public version.
as i didn't get any bug reports about alpha 13 i decided 2 make it public.

plop

[Jaakko]

So is it a finished version or do you need to do something infernal to it before it works?

Something like downloading dch++:

"1) Go and get svn, then try to get it working for an hour.
2) Throw your new pc out of the window, and bang your head to the wall for an another hour when it still doesn't work
3) Forget steps 1 & 2 and download the binary from dc++ with your 200Mhz P2"

 :D

[plop]

Originally posted by Jaakko
So is it a finished version or do you need to do something infernal to it before it works?

it works from the box (rar actualy), but you can tweak every setting so it fully fits your needs.

and you made a mistake on step 2 for installing dch++.
2) send your pc 2 plop and buy a new 1, then start banging your head.

plop

[Sarpanch]

Hi there can anyone plz giv me the link for the new Deflood? thanks