Undernet K-Line and G-Line FAQ
Version 1.0 - Written by Moridin
October 30th, 1997
Version 2.0 (Updated and revised)
By stoney` (Py Fivestones)
September 24, 2002
1.0 - Introduction
This FAQ was written with the intent of providing a quick reference on
K-Lines and G-Lines. Its initial purpose is to inform users as to what
they are, why they are used, and what users can do about them, if affected.
2.0 - What is a K-Line?
Technically, a K-Line is a line in an IRC server's configuration
files, specifying which hosts will not be allowed to connect to it.
Servers have multiple K-Lines, each denying access to a single
person, a domain (e.g., a particular ISP), or an entire country.
In real terms, a K-Line is a ban from an entire server, placed for
one of several reasons.
2.1 - Why are K-Lines used?
K-Lines are used for many different reasons. The three main ones are:
Those are the main three reasons K-Lines are used, although there are
several others. These include but are not limited to a broken reverse
lookup (in-addr.arpa), or nonexistent reverse lookup. Whilst not
really a K-Line as such, if you're getting the "No authorization"
message, it's an indication that your ISP's reverse lookup is broken.
You need to talk to your ISP about this.
A server has limited resources, and administrators prefer to offer
those to more local clients. Hence, clients from European
countries may not be allowed to connect to American-based servers
and vice versa. The server will usually give you a message, such as
"Use US.undernet.org." or "Use A Closer Server." In most cases,
using a closer server geographically speaking will give you a
less lagged connection with faster ping times.
- Network Topology
This overlaps slightly with geographical K-Lines. While it obviously
makes sense for someone in Norway to use a Norwegian-based server,
both for geographical and topological reasons, there are occasions
when the closest server geographically is not the best to use. This
is usually due to the way an ISP is connected to its uplink providers.
With some of the larger ISPs, it is faster to connect to a server on
their internal backbone rather than externally. Also, if an ISP has
its own server, then using it will allow others to use the more
generic servers. K-Lines will dictate if this is the case; for
example, a K-Line for Erols users saying "Please use the Erols
Undernet server - Arlington.VA.US.Undernet.Org."
Similar K-Lines may exist for America Online (AOL), directing
users to the AOL Undernet server, washington.dc.us.undernet.org.
Many server administrators will K-Line particular people or sites
they know to have abused the resources of the network in the past.
If, when connecting to a particular server, you get a message like
"clones abuse," "floodnet," "bots abuse," "Rogue ISP," or "mass
advertising," etc., then it's probable you or your ISP have been
K-Lined due to abuse. If you feel this is unjust, see section 2.2
for courses of action.
2.2 - What can I do about a K-Line?
To have a K-Line removed, either you or your ISP should email the
administrator of the particular server, and explain why they should
remove it. In the case of a geographical or topological ban, it is
unlikely that it will be removed.
In the case of abuse, the server administrator will want confirmation
that it will not happen again. This means getting one of the staff
from your ISP to contact them. Before you ask this of your ISP, make
sure they have all the information they'll need. Tell them what the
K-Line message says and point them to the Undernet Acceptable Use
so they know what is and isn't tolerated. Then give them the server
administrator's email address.
To find out the administrator of a server, and how to contact them,
use your web browser and go to:
Once there, click on the server administrator's nickname for their
Note, however, that if the admin has gone to the effort of adding a
K-Line due to abuse, it means they've had significant problems with
your site. They won't be likely to remove the ban unless your ISP is
willing to guarantee they'll crack down hard on any further abuse.
3.0 - What is a G-Line?
While a K-Line is a physical entry in a server's configuration files,
a G-Line is a network-wide global ban which is kept in memory until
it expires. A G-Line can be placed on a specific server or group of
servers, but generally is used to ban a person, domain, or country
from every server on the network. G-Lines are usually set for 1 to 2
hours, although if a user or site is extremely troublesome, they can
be set for years.
3.1 - Why are G-Lines used?
G-Lines are used solely to prevent further abuse of the Undernet. If
you are G-Lined, it means either you or someone from your ISP has
seriously violated the Undernet Acceptable Use Policy, which can be
found at: http://www.user-com.undernet.org/documents/aup.php.
The most common reasons for G-Lines are repeated cloning, advertising,
mass messaging, flooding, harassment or denial of service attacks.
3.2 - What can I do about a G-Line?
The first thing to remember is a G-Line usually lasts 1 or 2 hours. By
the time you write a letter and receive a reply, those two hours will
have passed. You may be better off just waiting. If you find that the
G-line is for a longer duration, it's a sign that Undernet has already
contacted your ISP and found them unwilling or unable to take actions
to assure their customers do not abuse the network.
If the G-line message says insecure proxy or open wingate it is because
when you first connect to Undernet, the server checks if you have an
Unsecured connection (an open port that can allow others to control
your computer remotely). If it detects this situation, it sends you the
message that you receive and doesn't allow you to join IRC. The web
page in the server message (http://www.undernet.org/proxyscan.php)
gives you directions on how to fix your problem. If the web page doesn't
help you, contact the company that wrote or manufactured the proxy
program/hardware, or contact your site administrator or your ISP.
If the G-Line is just for you, look at what the message says, and
work out what you may have done wrong. Familiarize yourself with the
Undernet's server policies. A whole range of useful information
(including how to fix insecure proxies and wingates) is available
If your whole site is G-Lined, not just you, then you need to talk
to your ISP. The most common reason for an entire site to be banned
is because the people who run that ISP do not deal with abuse. IRC
Operators/administrators will normally inform an ISP when placing a
site ban, and it is up to the ISP to deal with their abusive client
or clients. Unfortunately ISPs are sometimes rather lax about an IRC
ban and need a request from their own customers before they will
attempt to fix the problem.
Email the ISP administrators the entire G-Line message. This will
usually give enough information to determine which user was causing
trouble. If your ISP deals with the troublemakers by cooperating with
the Undernet administration, you shouldn't run into any more G-Lines.
If your ISP is unwilling or unable to do so, however, then it may be
time to vote with your money, so to speak, and change ISPs.
Should you wish to protest a G-Line, email all pertinent information
to email@example.com. This is the same address your ISP should
contact if they want further details to track down a customer who is
abusing Undernet resources.
© 1997-2002 Undernet User Committee
Please direct all comments concerning this FAQ to