Slow Spamfilter Detection

d5142341.cable.wanadoo.nl

   client = yes
   [irc]
   accept = 127.0.0.1:6667
   connect = irc.myserv.com:6697

*** ChanOp sets mode: +f [20j,50m,7n]:15
<ChanOp> lalala
*** Evil1 (~fdsdsfddf@Clk-17B4D84B.blah.net) has joined #test
*** Evil2 (~jcvibhcih@Clk-3472A942.xx.someispcom) has joined #test
*** Evil3 (~toijhlihs@Clk-38D374A3.aol.com) has joined #test
*** Evil4 (~eihjifihi@Clk-5387B42F.dfdfd.blablalba.be) has joined #test
-- snip XX lines --
*** Evil21 (~jiovoihew@Clk-48D826C3.e.something.org) has joined #test
-server1.test.net:#test *** Channel joinflood detected (limit is 20 per 15 seconds), putting +i
*** server1.test.net sets mode: +i
<Evil2> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
<Evil12> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
<Evil15> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
<Evil10> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
<Evil8> fsdjfdshfdkjfdkjfdsgdskjgsdjgsdsdfsfdujsflkhsfdl
-- snip XX lines --
-server1.test.net:#test *** Channel msg/noticeflood detected (limit is 50 per 15 seconds), putting +m
*** server1.test.net sets mode: +m
*** Evil1 is now known as Hmmm1
*** Evil2 is now known as Hmmm2
*** Evil3 is now known as Hmmm3
*** Evil4 is now known as Hmmm4
*** Evil5 is now known as Hmmm5
*** Evil6 is now known as Hmmm6
*** Evil7 is now known as Hmmm7
*** Evil8 is now known as Hmmm8
-server1.test.net:#test *** Channel nickflood detected (limit is 7 per 15 seconds), putting +N
*** server1.test.net sets mode: +N

spamfilter {
	regex "//write \$decode\(.+\|.+load -rs";
	target { private; channel; };
	reason "Generic $decode exploit";
	action block;
};
set { allowed-nickchars { latin1; }; };
set { allowed-nickchars { chinese-simp; chinese-trad; }; };
<block-name> <block-value> {
	<block-directive> <directive-value>;
};

me {
	name <name-of-server>;
	info <server-description>;
	numeric <server-numeric>;
};

me {
	name "irc.foonet.com";
	info "FooNet Server";
	numeric 1;
};

admin {
	<text-line>;
	<text-line>;
};

admin {
	"Bob Smith";
	"bob";
	"widely@used.name";
};

class <name> {
	pingfreq <ping-frequency>;
	connfreq <connect-frequency>;
	maxclients <maximum-clients>;
	sendq <send-queue>;
	recvq <recv-queue>;
};

class clients {
	pingfreq 90;
	maxclients 500;
	sendq 100000;
	recvq 8000;
};

class servers {
	pingfreq 90;
	maxclients 10; /* Max servers we can have linked at a time */
	sendq 1000000;
	connfreq 100; /* How many seconds between each connection attempt */
};

allow {
	ip <user@ip-connection-mask>;
	hostname <user@host-connection-mask>;
	class <connection-class>;
	password <connection-password> { <auth-type>; };
	maxperip <max-connections-per-ip>;
	redirect-server <server-to-forward-to>;
	redirect-port <port-to-forward-to>;
	options {
		<option>;
		<option>;
		...
	};
};

allow {
	ip *;
	hostname *;
	class clients;
	maxperip 5;
};

allow {
	ip *@*;
	hostname *@*.passworded.ugly.people;
	class clients;
	password "f00Ness";
	maxperip 1;
};

listen <ip:port> {
	options {
		<option>;
		<option>;
		...
	};
};

listen *:6601 {
	options {
		ssl;
		clientsonly;
	};
};


oper <name> {
	from {
		userhost <hostmask>;
		userhost <hostmask>;
	};
	password <password> { <auth-type>; };
	class <class-name>;
	flags <flags>;
	flags {
		<flag>;
		<flag>;
		...
	};
	swhois <whois info>;
	snomask <snomask>;
	modes <modes>;
	maxlogins <num>;
};

oper bobsmith {
	class clients;
	from {
		userhost bob@smithco.com;
		userhost boblaptop@somedialupisp.com;
	};
	password "f00";
	flags {
		netadmin;
		can_gkline;
		can_gzline;
		can_zline;
		can_restart;
		can_die;
		global;
	};
	swhois "Example of a whois mask";
	snomask frebWqFv;
};

drpass {
	restart <restart-password> { <auth-type>; };
	die <die-password> { <auth-type>; };
};
drpass {
	restart "I-love-to-restart";
	die "die-you-stupid";
};

include mynetwork.network;
include aliases/ircservices.conf
loadmodule "src/modules/commands.so";
loadmodule "src/modules/cloak.so";

loadmodule "modules/commands.dll";
loadmodule "modules/cloak.dll";

log <file-name> {
	maxsize <max-file-size>;
	flags {
		<flag>;
		<flag>;
		...
	};
};

log ircd.log {
	maxsize 5MB;
	flags {
		errors;
		kills;
		oper;
		kline;
		tkl;
	};
};

tld {
	mask <hostmask>;
	motd <motd-file>;
	rules <rules-file>;
	shortmotd <shortmotd-file>;
	opermotd <opermotd-file>;
	botmotd <botmotd-file>;
	channel <channel-name>;
	options {
		ssl;
	};
};
tld {
	mask *@*.fr;
	motd "ircd.motd.fr";
	rules "ircd.rules.fr";
};
ban nick {

	mask <nickname>;
	reason <reason-for-ban>;
};
ban nick {
	mask "*C*h*a*n*S*e*r*v*";
	reason "Reserved for Services";
};
ban user {
	mask <hostmask>;
	reason <reason-for-ban>;
};
ban user {
	mask *tirc@*.saturn.bbn.com;
	reason "Idiot";
};
ban ip {
	mask <ipmask>;
	reason <reason-for-ban>;
};
ban ip {
	mask 192.168.1.*;
	reason "Get a real ip u lamer!";
};
ban server {
	mask <server-name>;
	reason <reason-for-ban>;
};
ban server {
	mask broken.server.my.network.com;
	reason "Its broken!";
};
ban realname {
	mask <realname-mask>;
	reason <reason-for-ban>;
};
ban realname {
	mask "Bob*";
	reason "Bob sucks!";
};
ban version {
	mask <version-mask>;
	reason <reason-for-ban>;
	action [kill|tempshun|shun|kline|zline|gline|gzline];
};
ban version {
	mask "*SomeLameScript*";
	reason "SomeLameScript contains backdoors";
};
ban version {
	mask "*w00tZombie*";
	reason "I hate those hundreds of zombies";
	action zline;
};
except ban {
	mask <hostmask>;
};
except ban {
	mask myident@my.isp.com;
};
except tkl {
	mask <hostmask>;
	type <type>;
	type { 
		<type>;
		<type>;
		...
	};
};
except tkl {
	mask myident@my.isp.com;
	type gline;
};
except throttle {
	mask <ipmask>;
};
except throttle {
	mask 192.168.1.*;
};
deny dcc {
	filename <file-to-block>;
	reason <reason-for-ban>;
	soft [yes|no];
};
deny dcc {
	filename virus.exe;
	reason "This is a GD Virus";
};

deny dcc {
	filename "*.exe";
	reason "Executable content";
	soft yes;
};
deny version {
	mask <server-name>;
	version <version-number>;
	flags <compile-flags>;
};
deny link {
	mask <server-name>;
	rule <crule-expression>;
	type <type-of-denial>;
};
deny channel {
	channel "<channel-mask>";
	reason <reason-for-ban>;
	redirect "<channel-name>";
	warn [on|off];
};
deny channel {
	channel "#unrealsucks";
	reason "No it don't!";
};

deny channel {
	channel "#*teen*sex*";
	reason "You == dead";
	warn on;
};

deny channel {
	channel "#operhelp";
	reason "Our network help channel is #help, not #operhelp";
	redirect "#help";
};
allow channel {
	channel "<channel-mask>";
};
allow channel {
	channel "#something";
};
allow dcc {
	filename "<filename-mask>";
	soft [yes|no];
};
allow dcc {
	filename "*.jpg"; /* Images are usually safe */
	soft yes;
};
vhost {
	vhost <vhost>;
	from {
		userhost <hostmask>;
		userhost <hostmask>;
		...
	};
	login <login-name>;
	password <password> { <auth-type>; };
	swhois "<swhois info>";
};
vhost {
	vhost my.own.personal.vhost.com;
	from {
		userhost my@isp.com;
		userhost myother@isp.com;
	};
	login mynick;
	password mypassword;
	swhois "Im Special";
};
badword <type> {
	word <text-to-match>;
	replace <replace-with>;
	action <replace|block>;
};
badword channel {
	word shit;
	replace shoot;
};
ulines {
	<server-name>;
	<server-name>;
	...
};
ulines {
	services.mynetwork.com;
	stats.mynetwork.com;
};
link <server-name> {
	username <usermask>;
	hostname <ipmask>;
	bind-ip <ip-to-bind-to>;
	port <port-to-connect-on>;
	password-connect <password-to-connect-with>;
	password-receive <password-to-receive> { <auth-type>; };
	hub <hub-mask>;
	leaf <leaf-mask>;
	leafdepth <depth>;
	class <class-name>;
	ciphers <ssl-ciphers>;
	options {
		<option>;
		<option>;
		...
	};
};
link hub.mynet.com {
	username *;
	hostname 1.2.3.4;
	bind-ip *;
	port 7029;
	hub *;
	password-connect "LiNk";
	password-receive "LiNk";
	class servers;
	options {
		autoconnect;
		ssl;
		zip;
	};
};
alias <name> {
	target <nick-to-forward-to>;
	type <type-of-alias>;
	spamfilter <yes|no>;
};
alias <name> {
	/* For aliases to be sent to users/channels */
	format <regex-expression> {
		target <nick-to-forward-to>;
		type <type-of-alias>;
		parameters <parameter-string>;
	};
	/* For 'real aliases' */
	format <regex-expression> {
		command <command>;
		type real;
		parameters <parameter-string>;
	};
	/* Etc... You can have as many format blocks as you wish.. */
	format <regex-expression> {
		...
	};
	type command;
	spamfilter <yes|no>;
};
help <name> {
	<text-line>;
	<text-line>;
	...
};
official-channels {
	"#channel" { topic "The default topic"; };
};
official-channels {
	"#Help" { topic "The official help channel, if nobody is present type /helpop helpme"; };
	"#Home";
	"#Main" { topic "The main channel"; };
};
spamfilter {
	regex <word>;
	target { <target(s)> };
	action <action>;
	reason <reason>;
	ban-time <time>;
};
spamfilter {
	regex "Come watch me on my webcam";
	target { private; channel; };
	action gline;
	reason "You are infected, please go to www.antivirus.xx/blah/virus=GrrTrojan";
	ban-time 6h;
};

spamfilter {
	regex "come to irc\..+\..+";
	target { private; channel; };
	action gline;
	action gline;
	reason "No spamming allowed";
};

cgiirc {
	type <webirc|old>;
	username <mask>; /* optional */
	hostname <mask>;
	password <password>; /* only for type webirc */
};
webirc_password = LpT4xqPI5
cgiirc {
	type webirc;
	hostname "1.2.3.4";
	password "LpT4xqPI5";
};
realhost_as_password = 1
cgiirc {
	type old;
	hostname "1.2.3.4";
};
set {
	<entry> <value>;
	<entry> <value>;
	...
};
set {
	kline-address my@emailaddress.com;
	auto-join #welcome;
	options {
		hide-ulines;
	};
	hosts {
		local LocalOp.MyNet.com;
		global globalop.mynet.com;
	};
};
unrealircd.conf
files {
	motd <motd file>;
	shortmotd <short motd file>;
	opermotd <oper motd file>;
	svsmotd <services motd file>;
	botmotd <bot motd file>;

	rules <rules file>;

	tunefile <tune file>;
	pidfile <pid file>;
};

files {
	motd /etc/motd;

	pidfile /var/lib/run/unrealircd.pid;
};

alnum
alpha
blank
cntrl
digit
graph
lower
print
punct
space
upper
xdigit
\b
\B
\d
[[:digit:]]
\D
[^[:digit:]]
\s
[[:space:]]
\S
[^[:space:]]
\w
[[:alnum:]_]
\W
[^[:alnum:]_]

type:	name:	default action:	other avail. actions:	comments
c	CTCPs	auto +C	m, M
j	joins	auto +i	R
k	knocks	auto +K		(counted for local clients only)
m	messages/notices	auto +m	M
n	nickchanges	auto +N
t	text	kick	b	per-user messages/notices like the old +f. Will kick or ban the user.

type:	name	explanation:
~q	quiet	People matching these bans can join but are unable to speak, unless they have +v or higher. Ex: ~q:!@blah.blah.com
~n	nickchange	People matching these bans cannot change nicks, unless they have +v or higher. Ex: ~n:!@.aol.com*
~c	[prefix]channel	If the user is in this channel then (s)he is unable to join. A prefix can also be specified (+/%/@/&/~) which means that it will only match if the user has that rights or higher on the specified channel. Ex: +b ~c:#lamers, +e ~c:@#trusted
~r	realname	If the realname of a user matches this then (s)he is unable to join. Ex: ~r:Stupid_bot_script NOTE: an underscore ('_') matches both a space (' ') and an underscore ('_'), so this ban would match 'Stupid bot script v1.4'.

Name:	Description:	Character set/encoding:
catalan	Catalan characters	iso8859-1 (latin1)
danish	Danish characters	iso8859-1 (latin1)
dutch	Dutch characters	iso8859-1 (latin1)
french	French characters	iso8859-1 (latin1)
german	German characters	iso8859-1 (latin1)
swiss-german	Swiss-German characters (no es-zett)	iso8859-1 (latin1)
icelandic	Icelandic characters	iso8859-1 (latin1)
italian	Italian characters	iso8859-1 (latin1)
spanish	Spanish characters	iso8859-1 (latin1)
swedish	Swedish characters	iso8859-1 (latin1)
latin1	catalan, danish, dutch, french, german, swiss-german, spanish, icelandic, italian, swedish	iso8859-1 (latin1)
hungarian	Hungarian characters	iso8859-2 (latin2), windows-1250
polish	Polish characters	iso8859-2 (latin2)
romanian	Romanian characters	iso8859-2 (latin2), windows-1250, iso8859-16
latin2	hungarian, polish, romanian	iso8859-2 (latin2)
polish-w1250	Polish characters, windows variant (unfortunately more common than iso)	windows-1250
slovak-w1250	Slovak characters, windows variant	windows-1250
czech-w1250	Czech characters, windows variant	windows-1250
windows-1250	polish-w1250, slovak-w1250, czech-w1250, hungarian, romanian	windows-1250
greek	Greek characters	iso8859-7
turkish	Turkish characters	iso8859-9
russian-w1251	Russian characters	windows-1251
belarussian-w1251	Belarussian characters	windows-1251
ukrainian-w1251	Ukrainian characters	windows-1251
windows-1251	russian-w1251, belarussian-w1251, ukrainian-w1251	windows-1251
hebrew	Hebrew characters	iso8859-8-I/windows-1255
chinese-simp	Simplified Chinese	Multibyte: GBK/GB2312
chinese-trad	Tradditional Chinese	Multibyte: GBK
chinese-ja	Japanese Hiragana/Pinyin	Multibyte: GBK
chinese	chinese-*	Multibyte: GBK
gbk	chinese-*	Multibyte: GBK

clientsonly	port is only for clients
serversonly	port is only for servers
java	CR javachat support
ssl	SSL encrypted port

Old Flag	New Flag	Description
o	local	Makes you a local operator
O	global	Makes you a global operator
C	coadmin	Makes you a coadmin
A	admin	Makes you a admin
a	services-admin	Makes you a services admin
N	netadmin	Makes you a Network Admin
r	can_rehash	Oper may use /rehash
D	can_die	Oper may use /die
R	can_restart	Oper may use /restart
h	helpop	Oper receives umode +h (helpop)
w	can_wallops	Oper can send /wallops
g	can_globops	Oper can send /globops
c	can_localroute	Can connect servers locally
L	can_globalroute	Can connect servers globally
k	can_localkill	Can /kill local users
K	can_globalkill	Can /kill global users
b	can_kline	Can use /kline
B	can_unkline	Can use /kline -u@h
n	can_localnotice	Can send local server notices
G	can_globalnotice	Can send global server notices
z	can_zline	Can use /zline
t	can_gkline	Can use /gline, /shun and /spamfilter
Z	can_gzline	Can use /gzline
W	get_umodew	Sets umode +W when u oper
H	get_host	Sets your host to an oper host
v	can_override	Can use OperOverride
q	can_setq	Can use usermode +q
X	can_addline	Can use /addline
d	can_dccdeny	Can use /dccdeny and /undccdeny

local	global	admin/coadmin	services-admin	netadmin
can_rehash	can_rehash	can_rehash	can_rehash	can_rehash
helpop	helpop	helpop	helpop	helpop
can_globops	can_globops	can_globops	can_globops	can_globops
can_wallops	can_wallops	can_wallops	can_wallops	can_wallops
can_localroute	can_localroute	can_localroute	can_localroute	can_localroute
can_localkill	can_localkill	can_localkill	can_localkill	can_localkill
can_kline	can_kline	can_kline	can_kline	can_kline
can_unkline	can_unkline	can_unkline	can_unkline	can_unkline
can_localnotice	can_localnotice	can_localnotice	can_localnotice	can_localnotice
	can_globalroute	can_globalroute	can_globalroute	can_globalroute
	can_globalkill	can_globalkill	can_globalkill	can_globalkill
	can_globalnotice	can_globalnotice	can_globalnotice	can_globalnotice
		global	global	global
		can_dccdeny	can_dccdeny	can_dccdeny
			can_setq	can_setq
				admin
				services-admin

errors	self explanatory
kills	logs /kill notices
tkl	logs info on *lines, shuns and spamfilters (adding/removing/expire)
connects	logs user connects/disconnects
server-connects	logs server connects/squits
kline	logs /kline usage
oper	logs oper attempts (both failed and successful)
sadmin-commands	logs /sa* (samode, sajoin, sapart, etc.) usage
chg-commands	logs /chg* (chghost, chgname, chgident, etc.) usage
oper-override	logs operoverride usage
spamfilter	logs spamfilter matches

1.2.3.4	normal IP
hub.blah.com	host: only for outgoing, cannot accept _incoming_ connections unless link::options::nohostcheck is present
*	cannot connect TO but will allow a server connection (with correct password) from everywhere
::ffff:1.2.3.4	for linking ipv6 to ipv4.

ssl	if you are connecting to a SSL port.
autoconnect	server will try to autoconnect, time specified in your class::connfreq (it's best to enable this only from one side, like leaf->hub)
zip	if you want compressed links, needs to be compiled in + set at both ends
nodnscache	don't cache IP for outgoing server connection, use this if it's an often changing host (like dyndns.org)
nohostcheck	don't validate the remote host (link::hostname), use this if it's an often changing host (like dyndns.org)
quarantine	opers on this server cannot get GLOBAL oper privileges (they will get killed), used for test links and such

ircd.motd	Displayed when a /motd is executed and (if ircd.smotd is not present) when a user connects
ircd.smotd	Displayed on connect only (short MOTD)
ircd.rules	Displayed when a /rules is executed
oper.motd	Displayed when a /opermotd is executed or when you /oper up
bot.motd	Displayed when a /botmotd is executed

Mode	Description
Channel Modes
A	Only Administrators may join
a <nick>	Makes the user a channel admin
b <nick!user@host>	Bans the given user from the channel
c	No ANSI color can be sent to the channel
C	No CTCP's allowed in the channel
e <nick!user@host>	Exception ban – If someone matches this, they can join a channel even if they match an existing ban
f [<number><type>]:<seconds>	Channel flood protection. See section 3.12 above for an extended description.
G	Makes channel G rated. Checks for words listed in the Badword Blocks, and replaces them with the words specified
h <nick>	Gives half-op status to the user
i	Invite required
I <nick!user@host>	Invite exceptions ("invex") - if someone matches this, they can bypass +i requirements to enter the channel.
j <joins:seconds>	Throttles joins per-user to joins per seconds seconds
K	/knock is not allowed
k <key>	Sets a key needed to join
l <##>	Sets max number of users
L <Chan>	If the amount set by +l has been reached, users will be sent to this channel
M	A registered nickname (+r) is required to talk
m	Moderated channel. Only +v/o/h users may speak
N	No nick name changes permitted
n	No messages from outside channels
O	Only IRCops may join
o <nick>	Gives a user channel operator status
p	Makes channel private
q <nick>	Sets channel owner
Q	Only U:Lined servers can kick users
R	Requires a registered nickname to join
S	Strips all incoming colors
s	Makes channel secret
t	Only chanops can set topic
T	No NOTICE's allowed in the channel
u	Auditorium – Makes /names and /who #channel only show channel ops
V	/invite is not allowed
v <nick>	Gives a voice to users. (May speak in +m channels)
z	Only clients on a Secure (SSL) Connection may join

Mode	Description
User Modes
A	Server Admin (Set in Oper Block)
a	Services Admin (Set in Oper Block)
B	Marks you as being a Bot
C	Co-Admin (Set in Oper Block)
d	Makes it so you can not receive channel PRIVMSGs (with the exception of text prefixed with certain characters, see set::channel-command-prefix)
G	Filters out all the bad words per configuration
g	Can send & read globops and locops
H	Hide IRCop Status (IRCop Only)
h	Available for help (HelpOp) (Set in OperBlock)
i	Invisible (not shown in /who)
N	Network Administrator (Set in Oper Block)
O	Local IRC Operator (Set in Oper Block)
o	Global IRC Operator (Set in Oper Block)
p	Hides the channels you are in from /whois
q	Only U:Lines can kick you (Services Admins Only)
R	Allows you to only receive PRIVMSGs/NOTICEs from registered (+r) users
r	Identifies the nick as being registered
S	Used to protect Services Daemons
s	Can listen to server notices (see section 3.3 above for more information)
T	Prevents you from receiving CTCPs
t	Says you are using a /vhost
V	Marks you as a WebTV user
v	Receives infected DCC Send Rejection notices
W	Lets you see when people do a /whois on you (IRCops Only)
w	Can listen to wallop messages
x	Gives user a hidden hostname
z	Indicates that you are an SSL client

Command	Description	Who
nick <newnickname>	Changes your online nick name. Alerts others to the change of your nick	All
whois <nick>	Displays information of user requested. Includes Full Name, Host, Channels User is in, and Oper Status	All
who <mask>	Who allows you to search for users. Masks include: nickname, #channel, hostmask (*.attbi.com)	All
whowas <nick> <maxreplies>	Displays information on a nick that has logged off. The <max replies> field is optional, and limits how many records will be returned.	All
ison <nick1 nick2 nick3 ...>	Allows you to check the online status of a user, or a list of users. Simple return, best used for scripts	All
join <channel1,channel2, ...>	Allows you to join channels. Using the /join #channel1,#channel2,#channel3 will allow you to join more than one channel at a time. The /join 0 command makes you PART all channels.	All
cycle <channel1, channel2, ...>	Cycles the given channel(s). This command is equivalent to sending a PART then a JOIN command.	All
motd <server>	Displays the servers motd. Adding a server name allows you to view motd’s on other servers.	All
rules <server>	Displays the ircd.rules of a server. Adding a server name allows you to view rules on other servers	All
lusers <server>	Displays current & max user loads, both global and local. Adding a server name allows you to view the statistics from other servers.	All
map	Displays a network map	All
quit <reason>	Causes you to disconnect from the server. If you include a reason, it will be displayed on all channels as you quit	All
ping <user>	Sends a PING request to a user. Used for checking connection and lag. Servers issue pings on a timed basis to determine if users are still connected.	All
version <nick>	Sends a CTCP Version request to the user. If configured to do so, their client will respond with the client version.	All
links	Displays a list of all servers linked to the network	All
Admin <server>	Displays the admin info of a server. If a server name is included it will display the info of that server.	All
userhost <nick>	Displays the userhost of the nick given. Generally used for scripts	All
topic <channel> <topic>	Topic <channel> will display the current topic of the given channel. Topic <channel> <topic> will change the topic of the given channel.	All
invite <nick> <channel>	Invites the given user to the given channel. (Must be a channel Op)	ChanOp
kick <channel, channel> <user, user> <reason>	Kicks a user or users out of a channel, or channels. A reason may also be supplied.	ChanOp
away <reason>	Marks you as being away. A reason may also be supplied.	All
Watch +-<nick> +-<nick>	Watch is a new notify-type system in UnrealIRCd which is both faster and uses less network resources than any old-style notify system. The server will send you a message when any nickname in your watch list logs on or off. The watch list DOES NOT REMAIN BETWEEN SESSIONS - you (or your script or client) must add the nicknames to your watch list every time you connect to an IRC server.	All
helpop ?<topic> or !<topic>	HelpOp is a new system of getting IRC Server help. You type either /HELPOP ? <help system topic> or /HELPOP ! <question> The "?" in /HELPOP means query the help system and if you get no response you can choose '!' to send it to the Help Operators online. Using neither ? nor ! will mean the command will be first queried within the help system and if no match if found , it will be forwarded to the help operators	All
list <search string>	If you don't include a search string, the default is to send you the entire unfiltered list of channels. Below are the options you can use, and what channels LIST will return when you use them. >number List channels with more than <number> people. <number List channels with less than <number> people. C>number List channels created between now and <number> minutes ago. C<number List channels created earlier than <number> minutes ago. T>number List channels whose topics are older than <number> minutes (Ie., they have not changed in the last <number> minutes. T<number List channels whose topics are newer than <number> minutes. mask List channels that match mask !mask List channels that do not match mask	All
Knock <channel> <message>	Allows you to ‘knock’ on an invite only channel and ask for access. Will not work if channel has one of the following modes set: +K +V. Will also not work if you are banned	All
setname	Allows users to change their ‘Real Name’ without reconnecting	All
vhost <login> <password>	Hides your host name by using a vhost provided by the server.	All
mode <chan/nick> <mode>	Lets you set channel and user modes. See User & Channel Modes for a list.	All
credits	Lists credits for everyone that has helped create UnrealIRCd	All
license	Displays the GNU License	All
time <server>	Displays the servers date and time. Including a server name allows you to check other servers.	All
botmotd <server>	Displays the servers bot message of the day. Including a server name allows you to check other servers	All
identify <password>	Sends your password to the services system to identify to your nick.	All
identify <channel> <password>	Sends your password to the services system to identify as the founder of a channel.	All
dns <option>	Returns information about the IRC server's DNS cache. Note, since most clients have a built-in DNS command, you will most likely need to use /raw DNS to use this. Opers may specify an l as the first parameter to the command to receive a list of entries in the DNS cache.	All
userip <nick>	Returns the IP address of the user in question.	All
oper <userid> <password>	Command to give a user operator status if they match an Oper Block	IRCop
wallops <message>	Sends a message to all users with umode +w	IRCop
globops <message>	Sends a message to all global IRCops	IRCop
chatops <message>	Sends a message to all IRCops (local and global)	IRCop
locops <message>	Sends a message to all local IRCops	IRCop
adchat <message>	Sends a message to all Admins	IRCop
nachat <message>	Sends a message to all Net Admins	IRCop
kill <nick> <reason>	Kills a user from the network	IRCop
kline [+\|-]<user@host \| nick> [<time to ban> <reason>]	Bans the hostmask from the server it is issued on. A kline is not a global ban. time to ban is either: a) a value in seconds, b) a time value, like '1d' is 1 day or c) '0' for permanent. Time and reason are optional, if unspecified set::default-bantime (default: 0/permanent) and 'no reason' are used. To remove a kline use /kline -user@host	IRCop
zline [+\|-]<*@ip> [<time to ban> <reason>]	Bans an IP Address from the local server it is issued on (not global). See kline for more syntax info. Use /zline -*@ip to remove.	IRCop
gline [+\|-]<user@host \| nick> [<time to ban> <reason>]	Adds a global ban to anyone that matches. See kline for more syntax info. Use /gline -user@host to remove.	IRCop
shun [+\|-]<user@host \| nick> [<time to shun> <reason>]	Prevents a user from executing ANY commands and prevents them from speaking. Shuns are global (like glines). See kline for more syntax info. Use /shun -user@host to remove a shun.	IRCop
gzline [+\|-]<ip> <time to ban> :<reason>	Adds a global zline. See kline for more syntax info. Use /gzline -*@ip to remove a gzline.	IRCop
rehash <server> –<flags>	Rehashes the servers config file. Including a server name allows you to rehash a remote servers config file. Several flags are also available. They Include -motd - Only rehash all MOTD and RULES files (including tld {}) -opermotd - Only rehash the OPERMOTD file -botmotd - Only rehash the BOTMOTD file -garbage - Force garbage collection	IRCop
restart <password> <reason>	Restarts the IRCD Process. Password is required if drpass { } is present. You may also include a reason.	IRCop
die <password>	Terminates the IRCD Process. Password is required if drpass { } is present.	IRCop
lag <server>	This command is like a Sonar or Traceroute for IRC server. You type in /LAG irc.fyremoon.net and it will reply from every server it passes with time and so on. Useful for looking where lag is and optional TS future/past travels	IRCop
sethost <newhost>	Lets you change your vhost to what ever you want it to be.	IRCop
setident <newident>	Lets you set your ident to what ever you want it to be	IRCop
chghost <nick> <newhost>	Lets you change the host name of a user currently on the system	IRCop
chgident <nick> <newident>	Lets you change the ident of a user currently on the system	IRCop
chgname <nick> <newname>	Lets you change the realname of a user currently on the system	IRCop
squit <server>	Disconnects a server from the network	IRCop
connect <server> <port> <server>	If only one server is given, it will attempt to connect the server you are ON to the given server. If 2 servers are given, it will attempt to connect the 2 servers together. Put the leaf server as the first, and the hub server as the second.	IRCop
dccdeny <filemask> <reason>	Adds a DCCDENY for that filemask. Preventing that file from being sent.	IRCop
undccdeny <filemask>	Removes a DCCDENY	IRCop
sajoin <nick> <channel>, <channel>	Forces a user to join a channel(s). Available to services & network admins only	IRCop
sapart <nick> <channel>, <channel>	Forces a user to part a channel(s). Available to services & network admins only.	IRCop
samode <channel> <mode>	Allows Network & Services admins to change modes of a channel without having ChanOps.	IRCop
rping <servermask>	Will calculate in milliseconds the lag between servers	IRCop
trace <servermask\|nickname>	When used on a user it will give you class and lag info. If you use it on a server it gives you class/version/link info.	IRCop
opermotd	Displays the servers OperMotd File	IRCop
addmotd :<text>	Will add the given text to the end of the Motd	IRCop
addomotd :<text>	Will add the given text to the end of the OperMotd	IRCop
sdesc <newdescription>	Allows server admins to change the description line of their server without restarting.	IRCop
addline <text>	Allows you to add lines to the unrealircd.conf	IRCop
mkpasswd <password>	Will encrypt a clear text password to add it to the unrealircd.conf	IRCop
tsctl offset +/- <time>	Adjust the IRCD’s Internal clock (Do NOT use if you do not understand EXACTLY what it does)	IRCop
tsctl time	Will give a TS Report	IRCop
tsctl alltime	Will give a TS Report of ALL servers	IRCop
tsctl svstime <timestamp>	Sets the TS time of all servers (Do NOT use if you do not understand EXACTLY what it does)	IRCop
htm <option>	Controls settings related to high traffic mode. High Traffic Mode (HTM) basically disables certain user commands such as: list whois who etc in response to extremely high traffic on the server. Options include: -ON Forces server into HTM -OFF Forces server out of HTM -NOISY Sets the server to notify users/admins when in goes in and out of HTM -QUIET Sets the server to NOT notify when going in and out of HTM -TO <value> Tell HTM at what incoming rate to activate HTM	IRCop
stats <option>	B - banversion - Send the ban version list b - badword - Send the badwords list C - link - Send the link block list d - denylinkauto - Send the deny link (auto) block list D - denylinkall - Send the deny link (all) block list e - exceptthrottle - Send the except throttle block list E - exceptban - Send the except ban and except tkl block list f - spamfilter - Send the spamfilter list F - denydcc - Send the deny dcc block list G - gline - Send the gline and gzline list Extended flags: [+/-mrs] [mask] [reason] [setby] m Return glines matching/not matching the specified mask r Return glines with a reason matching/not matching the specified reason s Return glines set by/not set by clients matching the specified name I - allow - Send the allow block list j - officialchans - Send the offical channels list K - kline - Send the ban user/ban ip/except ban block list l - linkinfo - Send link information L - linkinfoall - Send all link information M - command - Send list of how many times each command was used n - banrealname - Send the ban realname block list O - oper - Send the oper block list P - port - Send information about ports q - sqline - Send the SQLINE list Q - bannick - Send the ban nick block list r - chanrestrict - Send the channel deny/allow block list R - usage - Send usage information S - set - Send the set block list s - shun - Send the shun list Extended flags: [+/-mrs] [mask] [reason] [setby] m Return shuns matching/not matching the specified mask r Return shuns with a reason matching/not matching the specified reason s Return shuns set by/not set by clients matching the specified name t - tld - Send the tld block list T - traffic - Send traffic information u - uptime - Send the server uptime and connection count U - uline - Send the ulines block list v - denyver - Send the deny version block list V - vhost - Send the vhost block list X - notlink - Send the list of servers that are not current linked Y - class - Send the class block list z - zip - Send compression information about ziplinked servers (if compiled with ziplinks support) Z - mem - Send memory usage information	All
module	Lists all loaded modules	All
close	This command will disconnect all unknown connections from the IRC server.	IRCOp