curious situation

katsklaw · Guru Joined: 28 Jun 2004 Posts: 1122

What exactly happens to scrawl's data when a server, lets call it irc.mynet.org delinks from a network and then links to another network and retains the exact same name?

So irc.mynet.org delinks from YXZNet and links to ABCNet but remains irc.mynet.org scrawl then connects and sees the same server name on a different network.

Jason · Posted: Feb 24, 2008 11:25am Post subject:

It senses a possible conflict and raises an alert.

katsklaw · Guru Joined: 28 Jun 2004 Posts: 1122

ok .. well I'm going off on a log entry for CollectiveIRC you once pasted to me that suggests that data collected while connected to that server is discounted as duplicated data, which IMHO could be a false assumption more times than true.

Additionally, a malicious user could fake an existing server name on an already indexed network to intentionally make scrawl see the server as a part of 2 networks. All it takes is a fake server resembling an existing server on an unrelated network be in the networks round robin.

For example irc.blackened.net is an EFnet server. All I would need to do is name a server on my network irc.blackened.net and have the IP for said server in my RR, regardless if I own the domain blackened.net or not. When scrawl connects to my RR and hits my faked name server it will see it as part of my network as well as a server on EFnet and start raising flags. Actually I could name all my servers the same as EFnet servers and completely screw things up.

Just thought you would like to know.

I'd also like to point out that the fact that scrawl even cares about server names is the main reason that CollectiveIRC even had problems with your indexing service and have absolutely no problem at all with netsplit.de .. it's simply because netsplit only care about the network name as returned by raw 005 and could care less about the server name it's self.

I'll paste the log to you that you once pasted to me so it jogs your memory.