[<GD>fruk]

Hello,

every time I have to fight a cheater who knows a bit more about that stuff (is aware of guids, have dynamic easily changeable IP) and, what is the worst, want to prove something and keeps changing variables mentioned above and is coming back just to annoy legit players and admins, I think of some heuristic bans implementation.

Firstly, I thought about following scenario:
- a cheater/asshat is banned (both guid and IP), his IP range taken from whois db is saved,
- an unknown player connects, we check his IP against whois-based banlist,
- if there is a match, we start additional checks (cause I can't ban just for belonging to the same range).

Now the question to the community: what additional checks could be implemented? I thought about using nmap and p0f (altough it's TCP only if I remember correctly) to OS fingerprint a remote machine. Some ports can be compared if they return specific string. In most cases, there will be some router, maybe webinterface which can be accessed. A spamfilter approach could be designed which gives a player some number of penalty points for every positive match. If a threshold is reached, then ban would be given.

The situation happens to me like few times a year, so I can afford doing it semi-automatic. Whois checks would be automatic, but I'd have to write additional checks manually, no problem.

Summing up, the first problem is how NOT to check everybody and ensure (with high probability) that cheater won't change easily the parameter for first check (whois match?). Second is what checks could be designed to generate some unique fingerprint of connecting player.

I know we will have auth system to help us, but.. WE WILL, dunno when.

[bw|lebbra]

waiting for auth system, you can use RedCap bot. It has the possibility to set a minimum notoriety level to play on the server.
A new player (or a cheater with a new guid) enter with notoriety 0. If min notoriety for playing is set to, let's say 0.2 he will be kicked off

Notoriety increases with guid aging and with played rounds, or by !trust command from admins
It decreases for cheat, guid changes, insults, tkills, etc..

the only problem is that newcomers will be kicked for some days before their notoriety increases enough to play. Usually you can workaround this problem, starting RedCap with min notoriety 0 for some days. After that, when usual players notoriety has been increased, you can set min notoriety to some positive value.

Or, you can simply keep always notoriety = 0 and just in case of some cheater or moron, bothering gameplay, you can rise min. notoriety level using in game command !notoriety

This post has been edited by lebbra: 29 August 2012 - 11:17 PM