# Security & anti-abuse

echoIRCd's anti-abuse is a **layered defence** rather than a single engine, applied at the cheapest
possible point in each case. (The behavioural DEFCON-style detection engine with a report-only mode
lives in [echo services](/docs/services-security), not in the daemon.)

## The layers

- **Upstream / provider** — volumetric floods (SYN/UDP/amplification) are handled before they reach
  the host.
- **Kernel / firewall** — SYN cookies, per-IP connection-rate limits, conntrack caps.
- **echoIRCd** — abusive *sessions* and *content*, described below.

## Accept edge

Rejection before any per-connection state is allocated:

- **`accept_rate` / `accept_burst`** — a per-source-IP token bucket, shared across the plaintext and
  TLS acceptors so one IP can't get a fresh budget per listener. Trusted proxies and server links are
  exempt.
- **`connflood`** — refuse connections from an IP opening too many too fast.
- **`connectban`** — Z-line an IP range that opens too many connections, with a boot grace period,
  garbage collection, and exemptions.

## Per connection

- **Clone caps** — connection classes cap concurrent per-IP connections (`localmax`, `globalmax`).
- **`registration_timeout`** — drop connections that never send NICK+USER.
- **`tls_handshake_timeout`** — reap sockets that open the TLS port but never negotiate.
- **`conn_waitpong`** — hold registration until the client echoes an exact PING cookie.
- **`recvq` / `softsendq` / `hardsendq`** — bound per-connection memory.

## Per message

- **Fakelag** — `flood_messages` per `flood_seconds` throttles a fast client (opers exempt); a class
  may set `fakelag=no` to disconnect instead.
- Channel modes **`+f`** (message flood), **`+j`** (join flood), **`+F`** (nick-change flood).

## Screening & scoring

- **DNSBL** — check DNS blocklists on connect; action `mark` / `kill` / `kline` / `gline` / `zline`.
- **Reputation** — accrue a per-address score over time; surfaces the `y:` extban and WHOIS.
- **Security groups** — named AND-ed user sets usable as the `g:` extban.

## Content & behaviour

`antirandom` (drone nick/ident/realname scoring), `antimixedutf8` (look-alike mixed-script spam),
`filter` / `badword` (`+G` censor), `solvemsg` (arithmetic PM gate), `recaptcha` /
`cloudflare_challenge` (registration gates), `autodrop` (HTTP-scanner connections), and `blockamsg`
(mass `/amsg`). See [Modules](/docs/modules) and the [Configuration reference](/docs/config-reference)
for the keys.

## Network bans

Persistent `K` / `G` / `Z` / `E` (exempt) / `Q` (nick) / `CBAN` (channel) / `SHUN` / `RLINE`
(realname) bans; `TLINE <mask>` reports how many current users a would-be ban would match before you
set it.