Internet Relay Chat flood

Flooding or scrolling on an IRC network is a method of disconnecting users from an IRC server (a form of Denial of Service), exhausting bandwidth which causes network latency ('lag'), or just annoying users. Floods can either be done by scripts (written for a given client) or by external programs.

It is possible to flood a client off the network simply by sending them data faster than they can receive it and thus cause a quit with the "max sendq exceeded" message, but this is generally only feasible if the user's connection is already slow/lagging and/or the attacker has a very large number of connections to the IRC network. Therefore, more common flooding techniques are based on the fact that the maximum number of messages that can be sent in a specified interval is controlled on the IRC server. Once this value is exceeded messages are stored in a buffer and delayed. If the buffer is filled the client is disconnected with an "Excess Flood" quit message. By sending messages that request an automated reply some IRC clients can be forced to flood themselves off.


Types of floods

A post flood on #wikipedia-en, using the common Internet term "OMG".
This is the simplest type of IRC flooding. It involves posting large amounts of posts or one very long post with repetitive text. It can also involve text with no meaning or no pertinence to the current discussion.[1] This type of flood is most commonly achieved by copying and pasting one short word repeatedly. Occasionally, when there are a large amount of small words, the entire message will be copied and pasted to produce massive amounts of text. This can, in turn, be done again, creating an exponential rise in the amount of text.
CTCP flood 
Since CTCP is implemented in almost every client,[citation needed] most users respond to CTCP requests. By sending too many requests, after a couple of answers they get disconnected from the IRC server. The most widely-used type is CTCP PING, although most clients also implement other CTCP replies.
DCC flood 
Initiating many DCC requests simultaneously. Theoretically it can also be used to disconnect users, because the target client sends information back about what port is intended to be used during the DCC session.
ICMP flood 
Typically referred to as a ping flood. This attack overloads the victim's internet connection with an amount of ICMP data exceeding the connection's capacity, potentially causing a disconnection from the IRC network. For the duration of the attack, the user's internet connection remains hindered. Technically speaking, this is not an IRC flood, as the attack itself doesn't traverse the IRC network at all, but operates entirely independent of anything but the raw internet connection and its IP protocol (of which ICMP is a subset). Even so, the actual IP address to flood (the address of the victim's connection) is frequently obtained by looking at the victim's user information (e.g. through the /whois or /dns command) on the IRC network.
Example of a message flood using over 50 clones.
Message flood 
Sending lots of private messages to the victim, mainly from different connections called clones (see below). Since some clients separate the private conversations into another window, each new message could open a new window for every new user a message is received from. This is exploitable by sending messages from multiple names, causing the target client to open many new windows and potentially swamping the user with boxes. Sometimes the easiest way to close all the windows is to restart the IRC client, although scripts (client extensions) exist to 'validate' unknown nicknames before receiving messages from them.
Notice flood 
Similar to the message, but uses the "notice" command.
Invite flood 
Sending a lot of invites.
Nick flood 
Changing the nick as fast as possible, thus making the conversation unenjoyable in the channel.
Connect flood 
Connecting and disconnecting from a channel as fast as possible, therefore spamming the channel with dis/connect messages, thus making the conversation unenjoyable.


Abusers do not flood from their own nicknames, because of the following reasons:

  • they can easily be K-Lined by administrators ('IRCops,' 'ServerOPs' or 'SOPs'),
  • banned from channels by operators ('ChanOPs' or 'OPs'),
  • from one user the flood is often not effective (The limits apply to the attacker too).

Instead clones are used, which are script or program controlled clients, primary designed to abuse others. When this method is used, it becomes easier to attack a user using many clones at the same time. Generally, the more clones an attacker has, the greater the chance of an attack succeeding. However the maximum connections from any one ip address are generally limited by the IRC network (either at the IRCD level or the services level).

One common way to increase the number of clones is by using open proxies. Basically these proxies are SOCKS or Squid-based, which support IRC connections by default. If one has a list of open proxies, he can use them to connect his clones through them to various IRC servers. Alternatively, compromised systems can be used to make the connections.

To prevent this, nowadays some IRC servers are configured to check common proxy ports of the client at the very beginning of the connection. If a successful proxy request can be done, it immediately drops the user (or clone). Other IRC networks use a separate proxy scanner that scans users as they join the network and kills or glines any users it detects an open proxy on. However this offers no protection against compromised systems or proxies on nonstandard ports (a full 65535 port scan isn't really feasible both for performance reasons and because it risks setting off Intrusion Detection Systems).


Almost every IRC client offers some kind of flood protection. These protections are based on the built-in "ignore" feature, which means that a given incoming message, CTCP, invitation, etc. will be blocked if the sender's hostmask matches any of the masks are defined in the ignore list. This is useful as few IRC networks implement the 'silence' command to reject messages by the server. In other words, every message will be posted to the correspondent user, whether it is a normal message or its content is intentionally malicious.

Many clients also limit the number of replies that can be sent in response to any incoming traffic from the network thus avoiding hitting the excess flood limit.

Flood protection in mIRC

There's also flood protection in the popular Windows-based client program, mIRC, in the Options menu. Users can set up some important values about how many incoming bytes are considered to be flooding, maximum incoming lines per user and ignorance time. Note that these settings are not enabled by default.

Despite these possibilities, there are much more sophisticated ways to eliminate flooding using mIRC scripts. These include additional features, such as CTCP cloaking, better message flood control, more adjustable flood triggers, and many others.

Firewalls and floods

Many users believe that installing a firewall will protect them against these attacks. But firewalls typically don't deal with this kind of application layer denial-of-service attack and no known application layer firewalls provide such protection for IRC at this time.

See also


  1. ^ An example of this would be someone posting the entire contents of a book or poem when the book or poem in question is unrelated to discussion.


External links

Wikimedia Foundation. 2010.

Look at other dictionaries:

  • Internet Relay Chat — IRC redirects here. For other uses, see IRC (disambiguation). For IRC channels dedicated to Wikipedia, see Wikipedia:IRC Internet Relay Chat (IRC) is a protocol for real time Internet text messaging (chat) or synchronous conferencing.[1] It is… …   Wikipedia

  • Internet Relay Chat services — AKill redirects here. For the creator of Akbot, whose online pseudonym is AKILL, see Owen Walker. Internet Relay Chat services (usually called IRC services) is a name for a set of features implemented on many modern Internet Relay Chat networks.… …   Wikipedia

  • Internet Relay Chat bot — An IRC bot performing a simple task. An IRC bot is a set of scripts or an independent program that connects to Internet Relay Chat as a client, and so appears to other IRC users as another user. An IRC bot differs from a regular client in that… …   Wikipedia

  • Internet Relay Chat — «IRC» redirige aquí. Para otras acepciones, véase IRC (desambiguación). Internet Relay Chat (IRC) Familia: Familia de protocolos de Internet Función: Conversación en tiempo real Última versión: 2.10 Puertos: 6667/TCP …   Wikipedia Español

  • Internet Relay Chat operator — The line that appears in an IRC Operator s client when they oper up An IRC operator (often abbreviated as IRCop or oper) is a user on an Internet Relay Chat network who has privileged access. IRC operators are charged with the task of enforcing… …   Wikipedia

  • Internet Relay Chat channel operator — An IRC channel operator (commonly shortened to op) is a user that moderates an IRC channel on a given IRC network. They are responsible for maintaining the modes of the channel, the banlist, and moderating any unwanted activity. IRC channel… …   Wikipedia

  • Comparison of Internet Relay Chat daemons — This list is incomplete; you can help by expanding it. The following tables compare general and technical information including the differences in feature sets between popular IRC daemons. Grey entries in the list represent supposedly… …   Wikipedia

  • Comparison of Internet Relay Chat clients — This article is about Internet Relay Chat clients. For a comparison of instant messaging clients, see Comparison of instant messaging clients. For a comparison of mobile Internet Relay Chat clients, see Comparison of mobile Internet Relay Chat… …   Wikipedia

  • Comparison of Internet Relay Chat services — This list is incomplete; you can help by expanding it. The following tables compare general and technical information including the differences in feature sets between various IRC services packages. This article is neither all inclusive nor… …   Wikipedia

  • Comparison of Internet Relay Chat bots — This list is incomplete; you can help by expanding it. The following table contains general and technical information about a range of Internet Relay Chat bots (IRC bots). General IRC Bot Primary developers Software license Operating system… …   Wikipedia

Share the article and excerpts

Direct link
Do a right-click on the link above
and select “Copy Link”

We are using cookies for the best presentation of our site. Continuing to use this site, you agree with this.