[tor-relays] Sustained large spike in outbound traffic - what might be going on?

[Tim Wilson-Brown - teor]

> On 23 Dec 2015, at 19:32, David Tomic <david at tomic.com.au> wrote:
> 
> Hello everyone,
> 
> I noticed something a little bit "odd" on one of my exit relays recently, and I just wanted to ask whether anybody might be able to account for what was actually happening, and whether it's likely to warrant any further investigation?
> 
> TLDR; I noticed a fairly significant spike - in excess of 30MB/s (yes, megabytes) - of outbound traffic compared to inbound.
> 
> http://s2.postimg.org/cvfzqvrsp/graph.png <http://s2.postimg.org/cvfzqvrsp/graph.png>
> 
> It persisted steadily for just over an hour, until I noticed what was going on and restarted Tor (not the whole server, only Tor), at which point my traffic appeared to return to normal again.
> 
> I have this relay running a a dedicated machine, with multiple physical NICs, and the ONLY thing which should be touching this NIC is my Tor traffic.
> 
> Thoughts?

Exit relays can end up with large traffic disparities for two reasons:
* small internet server requests can yield large internet server responses, or vice versa
* Tor cells are 512 bytes, if a small request or small response is embedded in a cell, the overhead can be quite large

This could happen because someone is uploading or downloading a large file.
But 30MB/s would probably require more than one client at the same time.

Tim

Tim Wilson-Brown (teor)

teor2345 at gmail dot com
PGP 968F094B

teor at blah dot im
OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20151229/f4484f50/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20151229/f4484f50/attachment.sig>