Anope IRC Services

Please login or register.

Login with username, password and session length
Advanced search  

News:

Pages: [1]   Go Down

Author Topic: Read error from server: Broken pipe  (Read 22019 times)

0 Members and 1 Guest are viewing this topic.

rapax

  • Anope User
  • Offline Offline
  • Posts: 3
Read error from server: Broken pipe
« on: September 06, 2008, 03:16:05 AM »
I've been getting hit everyday by some kids and the services are crashing every time. Is there a way to prevent this type of attack?

[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG nickserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG helpserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG operserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG chanserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG hostserv :help"
[Sep 05 16:04:44 2008] Ignored message from zRtyKfTcRsS: ":zRtyKfTcRsS PRIVMSG botserv :help"
[Sep 05 16:04:45 2008] Read error from server: Broken pipe

The attack is massive, this is the last portion, before the services crash.

Please advise...
Logged

deiks

  • Anope User
  • Offline Offline
  • Gender: Male
  • Posts: 139
  • Shizle my nizle
Re: Read error from server: Broken pipe
« Reply #1 on: September 06, 2008, 09:37:00 AM »
Use spamfilter nick match, or use proxy scanners.
There's no way to prevent it, if they're connected to server.
If they're connected then it's like regular user.

I'm using BOPM and AKILL.
Logged

Jan Milants

  • Team
  • *
  • Offline Offline
  • Gender: Male
  • Posts: 1372
Re: Read error from server: Broken pipe
« Reply #2 on: September 06, 2008, 10:39:27 AM »
consider lowering the sendq and receiveq of your client blocks...
Logged
If you like me donate coins to 1FBmZVT4J8WAUMHKqpWhgNVj3XXnRN1cCk :)

Jobe

  • Contributor
  • *
  • Offline Offline
  • Gender: Male
  • Posts: 1023
    • Anope IRC Services
Re: Read error from server: Broken pipe
« Reply #3 on: September 06, 2008, 11:55:21 AM »
Are you running UnrealIRCd? if so can you give us some examples of the nicks the drones are using please? The reason I ask is if they follow a patten, it may be possible to spamfilter them.
Logged
Your IP: ()
My IRC Status:

Come along and visit http://www.anopequotes.org/

rapax

  • Anope User
  • Offline Offline
  • Posts: 3
Re: Read error from server: Broken pipe
« Reply #4 on: September 06, 2008, 11:27:52 PM »
Thanks guys for the response.

I am using UnrealIRCD 3.2.7

This is a sample of how they are achieving the crashing of the services:

[Sep 06 16:01:47 2008] NickServ: Nick gEigFkRqXfZ has been requested
[Sep 06 16:01:48 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:48 2008] NickServ: Nick wZrmMpNaZiX has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick tBjqBiMsCrM has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick tTftQqEqHmN has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick nIrxWqKfSgL has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick aPvvZxSxAbR has been requested
[Sep 06 16:01:49 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:49 2008] NickServ: Nick kRzeDnFdEfY has been requested
[Sep 06 16:01:50 2008] NickServ: sent registration verification code to dasdsadsa@dsadsa.com
[Sep 06 16:01:50 2008] NickServ: Nick yIpjHdNgDsO has been requested


[Sep 06 16:02:26 2008] user: JOIN from nonexistent user xAhyQlRlNzQ: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user xGrpFmYxFnA: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user kZgdTfHmKeF: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user vRdePtSaFsS: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user vJrjObNyElS: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user iMosLhQxZwA: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user qOmqGdIsObK: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user xAhtWuXcSzH: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user fUvyScYqIyK: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user vGwcIyTsCzW: #chan
[Sep 06 16:02:26 2008] user: JOIN from nonexistent user bKxaTyBiQoQ: #chan


[Sep 06 16:02:27 2008] user: PART from nonexistent user xGrpFmYxFnA: #chan parting...
[Sep 06 16:02:27 2008] user: PART from nonexistent user xSexUrMcYhT: #chan parting...
[Sep 06 16:02:27 2008] user: JOIN from nonexistent user xSexUrMcYhT: #chan
[Sep 06 16:02:27 2008] user: PART from nonexistent user xSexUrMcYhT: #chan parting...
[Sep 06 16:02:27 2008] user: PART from nonexistent user xSexUrMcYhT: #chan parting...
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user kJecExNcGuL: Resource temporarily unavailable
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user rIgjSbMlHkE: Resource temporarily unavailable
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user fKxfAlHvGkH: Resource temporarily unavailable
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user lXfmGlWzLeQ: Max SendQ exceeded
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user mJisXsXqOiP: Dead socket
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user qOmqGdIsObK: Client exited
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user xAhtWuXcSzH: Client exited
[Sep 06 16:02:27 2008] user: QUIT from nonexistent user uLulXgMnPhD: Client exited
[Sep 06 16:02:27 2008] user: JOIN from nonexistent user xAhyQlRlNzQ: #chan
[Sep 06 16:02:27 2008] user: PART from nonexistent user uLnvEhTpOrN: #chan parting...
[Sep 06 16:02:27 2008] user: PART from nonexistent user xAhyQlRlNzQ: #chan parting...
[Sep 06 16:02:27 2008] Read error from server: Broken pipe

Again this is just a fraction of the logs.

When i restart services that email is changed and the crash is inevitable.
I use BOPM also.

Please advise...
Logged

Jobe

  • Contributor
  • *
  • Offline Offline
  • Gender: Male
  • Posts: 1023
    • Anope IRC Services
Re: Read error from server: Broken pipe
« Reply #5 on: September 07, 2008, 08:46:28 PM »
Oh goody, those nicks are easy.

As an oper with type:
/spamfilter add u gline - Botnet! ^(?-i)[a-z][A-Z][a-z][a-z][A-Z][a-z][A-Z][a-z][A-Z][a-z][A-Z](?i)!

That should catch them all.
Logged
Your IP: ()
My IRC Status:

Come along and visit http://www.anopequotes.org/

rapax

  • Anope User
  • Offline Offline
  • Posts: 3
Re: Read error from server: Broken pipe
« Reply #6 on: September 08, 2008, 01:36:48 PM »
They have not shown up yet to see if this worked. I will let you know.
Thank you guys. Thank you Jobe.
Logged
Pages: [1]   Go Up
« previous next »