dslreports logo
spacer
1
spacer
 
    All FAQs Site FAQ DSL FAQ Cable Tech About DSL Distance DSL Hurdles »»
spc

spacer



3. IRC Clients

AMENDMENT (Feb. 2, 2003) - Proxies are frequently used for spam. While they may work well on some networks, most will ban the proxy. Major networks run proxy scanners that check your IP on port 80, 8080, and 3128. If they find a proxy running on one of these, the proxy IP is banned from the server. If you really want to remain anonymous - purchase a shell account and run a BNC (IRC Bouncer) on it.

--------------------------------------------------------------

[ Anonymizing your IRC session - Revison 01a ]

07.02

Written by Joydrop

Resources required:

a] An IRC client capable of being SOCKSified or capable of direct HTTP proxy support
b] An SSL proxy, with a port that is open in your area - Available from Vlad's Page: tools.rosinstrument.com/cgi-bin/fp.pl/..[?]
d] Decision as to which IRC network you will be connecting to (as I will demonstrate later, this affects your choice of proxy or ability to connect)

Anonymizing your IRC session:

There are several ways to anonymize your session. The extent to which you anonymize it is up to you.

In this guide we will use HTTP proxies. An HTTP proxy caches information and acts as a buffer/cache between you and another host, usually a webhost. In this guide we will focus on HTTP proxies ability to understand the HTTP protocol.

Many HTTP proxies understand CONNECT, PROPFIND and other headers and so can be used to CONNECT to a server such as IRC, or anonymize email such as Hotmail. Modern IRC clients can be proxified (made to connect via an HTTP proxy) or socksified (made to connect via a Socks 4, 4a or 5 proxy).

------------

Let's begin.

I. Download and install your IRC program. I will refer to mIRC 6.02 in this guide.

II. Configure mIRC in the following way:

a. Press ALT-O and navigate to +Connect
b, Press the plus symbol next to Connect and navigate to the -Firewall tab.

II. Configuring the firewall tab:

----------------------------------------

Enable Firewall Support For:

[ ] Server [ ] DCC

Protocol:
[ ] Socks4 [ ] Socks5 [ ] Proxy

Hostname:
User ID:
Password:
Port:

---------------------------------------

IRC includes a direct client to client transfer protocol.
In the enable firewall support line, you have the option of
only using the proxy to send messages back and forth to the server
on the irc port you're connected to (usually 6667 but can be 6663 or 7000).

[x] Server - If you checkmark only [x] Server and leave DCC uncheckmarked, that's the behavior
you will have. If you accept a file or DCC chat with someone, they can type NETSTAT which will reveal
your IP. So don't accept DCC chats or file receives which you aren't expecting when connected this way.

[x] DCC - A few proxies are fast enough to DCC through. DCCng through a proxy depends on the host, and even when
possible, it is limited to the host's speed. If your proxy is on an ISDN 64kbps channel in Russia, and you're
an OOL user, don't expect 900kbps uploads!

[ ] The rest of the fields define the proxy host and protocol used to communicate with it.

--

As you can see, miRC has native support for SOCKS 4, 4A+5, and HTTP proxies. Let's connect using an http proxy.

I'm going to use a real free HTTP proxy. st156.mira29.vtsnet.ru:3128 which happens to be in Russia.

First, disconnect from any servers or multiserver.
Modify the mirc FIREWALL tab (ALT-O|Firewall) in the following way:

----------------------------------------

Enable Firewall Support For

[x] Server [ ] DCC

Protocol:
[ ] Socks4 [ ] Socks5 [x] Proxy

Hostname: st156.mira29.vtsnet.ru
User ID:
Password:
Port: 3128

----------------------------------------

What we just told mIRC to do is to send all traffic using CONNECT headers to an HTTP proxy host
and receive all traffic in the same way, EXCEPT dcc [which you still want to go client-to-client
for speed purposes]

Lets try connecting to several networks:

a. EFNET [which does not do "coordinated client scanning" like Dalnet. Each server does it's own!
---------------------------------------------------------------------------------- -------- -------

[11:01] * Connect retry #1 irc.inet.tele.dk (6667)
[11:01] -irc.inet.tele.dk- *** Looking up your hostname...
[11:01] -irc.inet.tele.dk- *** Checking Ident
[11:01] -irc.inet.tele.dk- *** Found your hostname
[11:01] -irc.inet.tele.dk- *** No Ident response
[11:01] -irc.inet.tele.dk- *** Banned: Open Proxy found on your host (2002/06/20 15.06)
[11:01] Closing Link: TestJoy[Sputnik@255.255.255.255] (Banned)

-- K-Line. Why? Because this server, irc.inet.tele.dk probed port 3128 on the connecting host
and found it to be open

[11:01] * Disconnected
[11:01] * Connect retry #2 efnet.cs.hut.fi (6667)
[11:01] -efnet.cs.hut.fi- *** Looking up your hostname...
[11:01] -efnet.cs.hut.fi- *** Checking Ident
[11:01] -efnet.cs.hut.fi- *** Found your hostname
[11:01] -efnet.cs.hut.fi- *** No Ident response
[11:01] Closing Link: TestJoy[unknown@255.255.255.255] (You are not authorized to use this server install ident!)

--- Closed connection. Why? Because the proxy could not reply to an ident request. Some (very few) proxies, notably
Cacheflow/1.0 hosts will reply with an ident.

[11:01] * Disconnected
[11:01] * Connect retry #3 irc.isdnet.fr (6668)
[11:01] -irc.isdnet.fr- *** Looking up your hostname...
[11:01] -irc.isdnet.fr- *** Checking Ident
[11:01] -irc.isdnet.fr- *** No Ident response
[11:01] -irc.isdnet.fr- *** Found your hostname
Welcome to the Internet Relay Network TestJoy
Your host is irc[irc/6668], running version 2.8/hybrid-6.2
[11:01] -irc.isdnet.fr- *** Your host is irc[irc/6668], running version 2.8/hybrid-6.2
This server was created Mon Oct 8 2001 at 13:46:52 CEST
irc.isdnet.fr 2.8/hybrid-6.2 oOiwszcrkfydnxb biklmnopstve
There are 7496 users and 72012 invisible on 44 servers

^^^^ SUCCCESS!!!!!!! ^^^

258 IRC Operators online
33314 channels formed
I have 2589 clients and 2 servers
Current local users: 2589 Max: 3275
Current global users: 79508 Max: 93172
Highest connection count: 3277 (3275 clients) (2018485 since server was (re)started)
Message of the Day, irc.isdnet.fr
End of /MOTD command.
* DCC Packet Size is 8192
* Fast Send is on
* Pdcc is on
Local host: st156.mira29.vtsnet.ru (195.151.213.156)
[11:01] * TestJoy sets mode: +i
NICKSERV Unknown command
TestJoy is ~Sputnik@st156.mira29.vtsnet.ru * Sputnik
TestJoy using irc.isdnet.fr Cable & Wireless France EFnet IRC Server, Paris
TestJoy has been idle 19secs, signed on Thu Jul 04 11:01:20
TestJoy End of /WHOIS list.
Message of the Day, irc.isdnet.fr
- Welcome to ___ ____ ____ _
- |_ _/ ___|| _ \ _ __ ___| |_
- | |\___ \| | | | '_ \ / _ \ __|
- | | ___) | |_| | | | | __/ |_
- |___|____/|____/|_| |_|\___|\__|

Now a server is sometimes lagged and you'll get disconnected after a welcome message. If you
don't get disconnected within the first few minutes, you should be OK until someone else
kills this proxy.

So lets join an Efnet channel and then /whois myself and /dns myself!

[11:16] * Now talking in #roswell
[11:16] * Topic is 'Come play trivia!'
[11:16] * Set by Nikole on Wed Jul 03 23:15:14
TestJoy is ~Sputnik@st156.mira29.vtsnet.ru * Sputnik
TestJoy using irc.isdnet.fr Cable & Wireless France EFnet IRC Server, Paris
TestJoy has been idle 2mins 20secs, signed on Thu Jul 04 11:01:20
TestJoy End of /WHOIS list.
TestJoy on #roswell

---

-------------------------------------------
b. Dalnet [Co-Ordinated scanning of nearly all common ports- success is unlikely unless using an odd port proxy or a proxy providing a unique ident]
-------------------------------------------

[11:18] -matrix.de.eu.dal.net- *** Looking up your hostname...
[11:18] -matrix.de.eu.dal.net- *** Checking Ident
[11:18] -matrix.de.eu.dal.net- *** Found your hostname
You have been Autokilled.
[11:18] -matrix.de.eu.dal.net- *** You are not welcome on this network.
[11:18] -matrix.de.eu.dal.net- *** Autokilled for [exp/ma] Your host/IP has been banned from DALnet. See kline.dal.net/exploits/akills.htm#ma[?] for reasons why. [AKILL ID:1025762282K-b] (2002/07/04 08.58)
[11:18] -matrix.de.eu.dal.net- *** Your hostmask is TestJoy!~Sputnik@st156.mira29.vtsnet.ru
[11:18] -matrix.de.eu.dal.net- *** For more information, please mail kline@dal.net and include everything shown here.
[11:18] Closing Link: 0.0.0.0 ([exp/ma] Your host/IP has been banned from DALnet. See kline.dal.net/exploits/akills.htm#ma[?] for reasons why. [AKILL ID:1025762282K-b] (2002/07/04 08.58))

^^ No joy.

The same for a few more servers. I had limited success with arcor.dal.net:

[11:21] -arcor.de.eu.dal.net- *** Looking up your hostname...
[11:21] -arcor.de.eu.dal.net- *** Checking Ident
[11:21] -arcor.de.eu.dal.net- *** Couldn't look up your hostname
[11:22] -arcor.de.eu.dal.net- *** No Ident response
Welcome to the DALnet IRC Network TestJoy!~Sputnik@195.151.213.156
Your host is arcor.de.eu.dal.net[@0.0.0.0], running version bahamut-1.4(34)
This server was created Mon May 27 2002 at 00:07:54 CEST
arcor.de.eu.dal.net bahamut-1.4(34) oiwscrknfydaAbghe biklLmMnoprRstvc
NOQUIT WATCH=128 SAFELIST MODES=13 MAXCHANNELS=10 MAXBANS=100 NICKLEN=30 TOPICLEN=307 KICKLEN=307 CHANTYPES=&# PREFIX=(ov)@+ NETWORK=DALnet SILENCE=10 CASEMAPPING=ascii are available on this server
There are 20 users and 2493 invisible on 3 servers
4 IRC Operators online
4562 channels formed
I have 2031 clients and 1 servers
Current local users: 2031 Max: 21113
Current global users: 2513 Max: 140146
[11:22] -arcor.de.eu.dal.net- *** Notice -- motd was last changed at 23/4/2002 17:58
[11:22] -arcor.de.eu.dal.net- *** Notice -- Please read the motd if you haven't read it
Message of the Day, arcor.de.eu.dal.net
Local host: st156.mira29.vtsnet.ru (195.151.213.156)
End of /MOTD command.
[11:22] -arcor.de.eu.dal.net- *** Notice -- This server runs an open proxy monitor to prevent abuse.
[11:22] -arcor.de.eu.dal.net- *** Notice -- If you see connections on various ports from proxy6.monitor.dal.net
[11:22] -arcor.de.eu.dal.net- *** Notice -- please disregard them, as they are the monitor in action.
[11:22] -arcor.de.eu.dal.net- *** Notice -- For more information please visit kline.dal.net[?]

[11:25] * Now talking in #windows95
TestJoy is ~Sputnik@195.151.213.156 * Sputnik
TestJoy on #windows95 #html
TestJoy using arcor.de.eu.dal.net www.arcor.de - Arcor Online Services
TestJoy has been idle 4mins 1sec, signed on Thu Jul 04 11:21:26
TestJoy End of /WHOIS list.

^^ Notice how this server's proxy monitor seemed lagged. It couldn't get my hostname
and it seems to me that it's just a stroke of luck. Sometimes Dalnet is possible, especially
if your proxy is on a NON-STANDARD port (check kline.dal.net[?] for ports they scan)

-------------------------------------------
c. Undernet (Active, co-ordinated scanning)
-------------------------------------------

No joy with the current proxy, but I'm showing you the method. I can easily find another one.

[11:32] -montreal.qu.ca.undernet.org- *** Checking Ident
[11:32] -montreal.qu.ca.undernet.org- *** Found your hostname
[11:32] -montreal.qu.ca.undernet.org- *** No ident response
AUTO [1] Misconfigured Proxy Server. Please visit www.undernet.org/proxyscan.php[?] .
[11:32] Closing Link: TestJoy by montreal.qu.ca.undernet.org (K-lined)
[11:32] * Disconnected
[11:32] * Connect retry #1 graz.at.eu.undernet.org (6665)
[11:32] -graz.at.eu.undernet.org- *** Looking up your hostname
[11:32] -graz.at.eu.undernet.org- *** Checking Ident
[11:32] -graz.at.eu.undernet.org- *** Found your hostname
[11:32] -graz.at.eu.undernet.org- *** No ident response
AUTO [1] Misconfigured Proxy Server. Please visit www.undernet.org/proxyscan.php[?] .
[11:32] Closing Link: TestJoy by graz.at.Eu.UnderNet.org (K-lined)
[11:32] * Disconnected
[11:32] * Connect retry #2 flanders.be.eu.undernet.org (6665)
[11:32] -flanders.be.eu.undernet.org- *** Looking up your hostname
[11:32] -flanders.be.eu.undernet.org- *** Checking Ident
[11:32] -flanders.be.eu.undernet.org- *** No ident response
[11:32] -flanders.be.eu.undernet.org- *** Found your hostname
AUTO [1] Misconfigured Proxy Server. Please visit www.undernet.org/proxyscan.php[?] .

So as you can see, I was disconnected three times from three different servers.
Before trying to connect with an open proxy, make sure the network is not scanning on a
co-ordinated basis the open proxy port! Otherwise you'll get nowhere.

-------------------------------------------
d. CRITTEN [Running hybrid ircD like Efnet, shouldn't be too hard - scanning practices unknown]
-------------------------------------------
No problem here:

[11:43] -ganja.uk.eu.criten.net- *** Looking up your hostname...
[11:43] -ganja.uk.eu.criten.net- *** Checking Ident
[11:43] -ganja.uk.eu.criten.net- *** No Ident response
[11:43] -ganja.uk.eu.criten.net- *** Found your hostname
Welcome to the Criten IRC Network TestJoy!~Sputnik@st156.mira29.vtsnet.ru
Your host is ganja.uk.eu.criten.net[@0.0.0.0], running version bahamut-1.4(33)
This server was created Mon Jun 24 2002 at 18:30:52 BST
ganja.uk.eu.criten.net bahamut-1.4(33) oiwscrknfydaAbghe biklLmMnoprRstvc
NOQUIT WATCH=128 SAFELIST MODES=6 MAXCHANNELS=14 MAXBANS=100 NICKLEN=30 TOPICLEN=307 KICKLEN=307 CHANTYPES=&# PREFIX=(ov)@+ NETWORK=Criten SILENCE=10 CASEMAPPING=ascii are available on this server
There are 29 users and 5108 invisible on 9 servers
22 IRC Operators online
884 channels formed
I have 546 clients and 1 servers
Current local users: 546 Max: 885
Current global users: 5137 Max: 8564
[11:43] -ganja.uk.eu.criten.net- *** Notice -- motd was last changed at 27/6/2002 8:21
[11:43] -ganja.uk.eu.criten.net- *** Notice -- Please read the motd if you haven't read it
Message of the Day, ganja.uk.eu.criten.net
End of /MOTD command.
[11:43] -ganja.uk.eu.criten.net- *** Notice -- This server runs an open proxy monitor to prevent abuse.
[11:43] -ganja.uk.eu.criten.net- *** Notice -- If you see connections on various ports from some.bot.host
[11:43] -ganja.uk.eu.criten.net- *** Notice -- please disregard them, as they are the monitor in action.
[11:43] -ganja.uk.eu.criten.net- *** Notice -- For more information please visit www.criten.net/proxies/[?]
[11:43] * TestJoy sets mode: +i
* DCC Packet Size is 8192
* Fast Send is on
* Pdcc is on
Local host: st156.mira29.vtsnet.ru (195.151.213.156)
Services is currently down. Please wait a few moments, and then try again.
#mp3 TestJoy @the
#mp3 End of /NAMES list.
TestJoy is ~Sputnik@st156.mira29.vtsnet.ru * Sputnik
TestJoy using ganja.uk.eu.criten.net Powered By www.oedipus.net
TestJoy has been idle 43secs, signed on Thu Jul 04 11:43:43
TestJoy End of /WHOIS list.
[11:44] * Looking up st156.mira29.vtsnet.ru
[11:44] * Resolved st156.mira29.vtsnet.ru to 195.151.213.156

[11:45] * Now talking in #xdcc
[11:45] * Topic is '[XDCC] bringing u the latest releases - 0sec ain't fast enuff for us [XDCC]'
[11:45] * Set by toon on Thu Jul 04 09:25:10

-------------------------------------------
e. Zerolimit [Running Co-Ordinated scanning much like Dalnet]
-------------------------------------------

[12:22] * Connect retry #1 irc.zerolimit.net (6667)
[12:22] -fear.us.zerolimit.net- *** Looking up your hostname...
[12:22] -fear.us.zerolimit.net- *** Found your hostname (cached)
[12:22] -fear.us.zerolimit.net- *** Checking ident...
[12:22] -fear.us.zerolimit.net- *** Checking for open socks server...
[12:22] -fear.us.zerolimit.net- *** No ident response; username prefixed with ~
[12:23] -fear.us.zerolimit.net- *** No socks server found (good)
[12:23] -fear.us.zerolimit.net- *** Notice -- It seems that you don't have identd installed on your host.
[12:23] -fear.us.zerolimit.net- *** Notice -- If you wish to have your username show up without the ~ (tilde),
[12:23] -fear.us.zerolimit.net- *** Notice -- then install identd.
*** You're using an insecure proxy. See www.zerolimit.net/proxy/[?] for information about how to config your proxy in a safe manner.
[12:23] Closing Link: TestJoy[st156.mira29.vtsnet.ru] (You are banned from using this server)
[12:23] * Disconnected
[12:23] * Connect retry #2 irc.zerolimit.net (6667)
[12:23] -fear.us.zerolimit.net- *** Looking up your hostname...
[12:23] -fear.us.zerolimit.net- *** Found your hostname (cached)
[12:23] -fear.us.zerolimit.net- *** Checking ident...
[12:23] -fear.us.zerolimit.net- *** Checking for open socks server...
[12:23] -fear.us.zerolimit.net- *** No ident response; username prefixed with ~
[12:24] -fear.us.zerolimit.net- *** No socks server found (good)
[12:24] -fear.us.zerolimit.net- *** Notice -- It seems that you don't have identd installed on your host.
[12:24] -fear.us.zerolimit.net- *** Notice -- If you wish to have your username show up without the ~ (tilde),
[12:24] -fear.us.zerolimit.net- *** Notice -- then install identd.
*** You're using an insecure proxy. See www.zerolimit.net/proxy/[?] for information about how to config your proxy in a safe manner.
[12:24] Closing Link: TestJoy[st156.mira29.vtsnet.ru] (You are banned from using this server)

^^ No luck with port 3128. Test proxies with ports 81, 8000 and of course uncommon port proxies.

---------------------------------------------------------------------------------- -----

In conclusion:

My advice: SET UP YOUR OWN proxy or bouncer running on a shell account. Speed will never be a problem,
you can use an IRC proxy which is more efficient than an HTTP or Socks proxy, and you can even have a neat
hostname. Research:

IRC Proxy Links:
~~~~~~~~~~~~~~~~
BNC: [ www.tldp.org/HOWTO/mini/IRC/bouncers.h..[?] ]
[www.shellnews.com/downloads/bncdownloa..[?]

PsyBNC: [ psybnc.yo.lv/[?] ]
[ www.netknowledgebase.com/tutorials/psy..[?] ]

Public HTTP Proxy links : tools.rosinstrument.com[?]
directory.google.com/Top/Computers/Int..[?]

You are done! To verify that your connection has been anonymized, type " //whois $me " when connected. Finally, please read the notes below which may help you resolve some server k-line issues on the large IRC networks, specifically EFNET and DALNET.

IMPORTANT NOTES REGARDING YOUR CHOICE OF PROXY.

There are some considerations to be made when selecting the proxy you are to be using. The primary consideration deals with it's presence or absence of an IDENT server. Some IRC networks such as EFNET now require that your client respond to the ident request, otherwise they will decline the connection. In such a case, there is a simple way (for now) to still use this method: Use a CacheFlow-Proxy. These proxies by default run an ident daemon, responding to ident requests on port 113 with the string "CacheFlowS". There may be other ssl proxies with ident daemons, however, the few others I tested did not run an ident server.

b. DALNET IRC NETWORK:

The reverse is true in the case of DALnet. The CacheFlow proxies are k-lined (blocked) from DALnet, and you MUST use a non-cacheflow proxy, such any of the ones below. For now, DALnet does NOT require ident, so any non-cacheflow SSL proxies should work. From a software configuration or anonymity viewpoint, this makes no practical difference. Remember that Dalnet scans common proxy ports so you'll need one on an odd port.

c. UNDERNET, CHATNET, RELICNET, IRCx (msn) AND OTHER NETWORKS:

The presence or absence of an ident server has no bearing on the success of connecting to these networks. As of now, any SSL proxy can be used, considering of course that the proxy's port is open in your area.

I am interested in feedback of those encountering public HTTP proxies with a working IDENT daemon (other than the Cacheflow ones I already know about.) One easy way to check whether your HTTP proxy runs an IDENT daemon is to surf to: ident.junkbusters.com/[?] , a junkbusters page which queries the auth port of the proxy and displays the results. I welcome any questions and/or comments. Email me at DViolet*@softhome.net

Thank you for your patience in reading this guide. I hope to have shed some light as to the amazing variety of possible data that can be tunneled through the HTTP protocol! Best of luck in your efforts to maintain privacy and to bypass censorship.

---

~Joydrop 7/02


by Joydrop See Profile edited by removed See Profile
last modified: 2003-02-02 10:57:54

The client is what you use to logon to the IRC server for the network you wish to join. Much like other chat-based software, like AIM, YIM, ICQ, et al., you must use a client to talk to the network.


by Ryokincaid See Profile

Sometimes, either the server or your mIRC client will mess up. Then, you are disconnected from the network. When you reconnect, you will probably get a message that your nick is already in use. This is because the server still thinks your client is connected. The server will ping you (the client) to make sure you are still there. When it gets no response, it knows that you are no longer active, and the connection between you and the server will die.

There are two ways to get past this:
A) Register your nick using NickServ (if the network offers it), and use the ghost command (/nickserv help ghost) to get the server to kill the old connection instantly.
B) Just wait for the server to see that the client is dead. This will usually take less than two minutes, but can take a little more sometimes.

I recommend that you register your nick at all times so that nobody else can log on as you.


by removed See Profile
last modified: 2002-07-14 13:39:25

Type "/join #channelname" where channelname is the name of the channel you want to join. Typing "/list" will give you a list of all occupied channels on the server.


by Techie2000 See Profile edited by removed See Profile
last modified: 2002-08-09 17:53:02

Check this out: »mirc.stealth.net/download/oldver ··· ver.html


Feedback received on this FAQ entry:
  • dead link.. try http://www.oldversion.com/program.php?n=mirc

    2008-11-03 13:34:39



by null9 See Profile edited by removed See Profile
last modified: 2005-10-11 17:39:08