To report a botnet PRIVATELY please email: [EMAIL PROTECTED] ---------- On Saturday 20 May 2006 17:57, Jörg Weber wrote: > Does someone have a clue what this beast is? If you're having trouble connecting, chances are that the IRC server is improperly configured. Some default installs of linux are configured with a max of 8192 file descriptors. Each connection to an IRC server uses a couple of descriptors. This can cause an IRC server to only sustain between 500 and 4000 connections.
I have seen many public IRC servers brought to their knees because someone tried to use it as a C&C. Even with triple zero load averages, the IRC server cannot establish any new connections. There is also a chance that the botnet is so large that the server, while properly configured, simply cannot keep up (CPU bottleneck, bandwidth, etc). Lastly, if you are having trouble extracting information from an IRC server, chances are the server is heavily modified. Servers are often modified to display no information (motd, luser stats, oper lists, chan lists) and have channels where only chan ops or ircops can intact with/see regular (read: drones) users. Craig _______________________________________________ To report a botnet PRIVATELY please email: [EMAIL PROTECTED] All list and server information are public and available to law enforcement upon request. http://www.whitestar.linuxbox.org/mailman/listinfo/botnets
