# $Id: flag-irc.bro,v 1.2 2002/10/13 21:07:59 vern Exp $
#
# include this module to flag various forms of IRC access.

redef ftp_hot_files +=
	  /.*eggdrop.*/
	| /.*eggsun.*/
	;

redef flag_successful_inbound_service: table[port] of string += {
	[[6666/tcp, 6667/tcp]] = "inbound IRC",
};

redef hot_dsts: table[addr] of string += {
	[[bitchx.com, ftp.eggdrop.net]] = "IRC source sites",
};
