View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001912 | unreal | ircd | public | 2004-07-01 23:43 | 2007-04-19 02:55 |
| Reporter | hypnetric | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | N/A |
| Status | closed | Resolution | wont fix | ||
| Product Version | 3.2 | ||||
| Summary | 0001912: Botnet detection on connect & other | ||||
| Description | It'd be cool to have a feature installed which does botnet checking on connect to the server. So say one client connects, the IRCD stores that nickname into memory, or the identity, or whatever necessary, and if the next connect matches, it begins to detect a connect of bots, and seq. This would be a very nice feature for helping to eliminate botnets from using your IRC network as a communications hub. Also maybe include a "scan block" which allows you to scan certain ports for trojans and viruses (maybe scriptable?) Okay, now you can put down my brilliant ideas with your words of power. | ||||
| 3rd party modules | |||||
|
|
Okay... first off, we have this wonderful thing called "spamfilter". Other than that, you can probably set up a bot that will connect as a server (similar to services), and then scan incoming connections for these ports. |
|
|
We may eventually consider a way to implement complex rules to detect botnets (regex bans are already on the todo list), but a scanning thing is NOT going to happen. If you want to scan, use BOPM. That is not the job of the IRCd. If you made the IRCd scan 10 ports per user, it would make it incredibly slow! Use a seperate program. Furthermore, you can't just say "scan for any trojan" each one is different. We'd have to spend all of our time finding out how to detect trojans, there are thousands! Each trojan would need a different scanner. This is not something that will ever be in Unreal. |
