Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

IRC is a handy tool at all sorts of levels:

  • Team communication
  • User community participation
  • Building customer service chat bots on an established protocol

For these reasons and more I've come to love irssi+screen. Why do hosting companies love to hate IRC? If it's just DDoS and warez they're worried about, surely those specific activities are already banned and easily detected?

share|improve this question

4 Answers 4

up vote 13 down vote accepted

Speaking as a former IRC op.

As productive as IRC can be for the well-mannered person, it's also the sort of place that tends to collect people with poor self-control. Younger people, the disaffected, mentally unbalanced, etc. When angered by some real or imagined slight, these folks tend to love launching DOS or DDOS attacks against the IRC servers and/or those IRC clients whose IP address is visible via a /WHOIS command.

A person determined to be a nuisance to your IRC server will continue being a nuisance for as long as he/she wishes. Many proxy lists are available to the determined nuisance; blocking/banning by IP address thus becomes a constant manual hassle. There's no sure way to automate it; these skript kiddies can and do vary their scripted or manual attacks quite often. Longterm the only way to win is to have a team of people who thus have a longer attention span than the average angry teenager.

An IRC server of any popularity at all is nearly guaranteed one or more such attacks per month; dealing with these attacks requires time, expertise, and tools that many low-cost hosting providers just don't have available and don't see any profit in acquiring.

I stay on IRC a fair amount of the time, via irssi/screen running at Silence Is Defeat (SiD). It costs a buck to signup, and there are no recurring costs. But the quality of service has been going downhill lately; the SiD server is often a tad overloaded and thus can lag a few seconds at times. So you might check out a few other free shell providers. If all you need is an irssi/screen host and the occasional ping/traceroute/nmap, you'll soon find one that works well for you.

rsync your homedir to your local machine every so often though; of course being free, you're not exactly gonna get an ironclad SLA!

share|improve this answer
    
Honestly, I just run screen+irssi on home NAS. However, i thought it might be nice to have the option to move it away from home and away from the RAM limitations embedded ARM carries. Having the capability to build and run a bot for constructive purposes might also be nice but it seems you need large amounts of money or trust. –  jldugger May 26 '09 at 18:17

IRC is regularly used in command and control systems for various internet worms, malware and spyware. I guess the overhead of determining the valid use of IRC is to high compared to the cost of being black hole routed if their IP block is suspected of hosting a botnet.

share|improve this answer

They view IRC network(s) as a haven for illegal activity such as software/music piracy, botnets, credit card fraud, etc..

Probably their biggest concern is their liability if a malicious user connects a botnet to their server to lauch attacks from or simply eat up alot of bandwidth.

share|improve this answer

How is it blocked?

Maybe the standard port is blocked. But why not use a non-standard port anyway to get a slightly improved security against the automated port scanners?

As for why it might be blocked, it could certainly be the concern for botnet herders or warez communities, but almost anything can be used for such purposes, so everything should be blocked to be really sure.

share|improve this answer
    
Stateful deep packet inspection firewalls can detect non-SSLed IRC traffic no matter what port it's on, and can therefore apply IRC policy to that traffic. Simple port-blocking is becoming more and more old-skool for network defense. The malware community certainly does port-hop, which has driven this innovation in defensive networking. –  sysadmin1138 May 26 '09 at 17:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.