RE: [NeoStats-Devel] FloodServ

Justin Hammond wrote:
> Some of the improvements that I had thought about was 
> extending it beyond the channel layer and move it to the IRCd layer.
> Eg:
> Add support for monitoring a large number of connects from 
> Class C networks (Hybrid TCM does this, but its usefullness 
> from the perspective of zombied machines might be limited now)
> 
> Add monitoring for the average number of connects on each 
> IRCd (eg, if my daily average connects is 1 connect every 10 
> seconds, and it all of a sudden jumped to 10 connects, we 
> might have a inbound flood.) There might not be much you can 
> do, but at least give the opers some warning...
> 
> Monitoring the channel joins/parts of users. Typically some 
> of the spam bots or stats bots that are out there will cycle 
> each public channel very quickly... 

This could be useful. If we take the webcamspam as an example, it joins
channels in order of the raw output of /list so a /join chan1, /part chan1,
/join chan2 etc would be sufficient to detect such bots. However, this would
mean we would have to maintain a raw list of channels via a client list
command unless we can determine an algorithm to identify the first few
channels that would be output via raw. I assume it could be determined from
TS but have not looked into it.

Mark.