<div dir="ltr">Thanks guys.  I have been keeping a close(r) eye on this server since it originally happened, but so far it seems to be behaving itself again.<div>I'll be ready to capture some more detailed data if it does decide to happen again though.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 29 December 2015 at 22:53, Tim Wilson-Brown - teor <span dir="ltr"><<a href="mailto:teor2345@gmail.com" target="_blank">teor2345@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><br><div><span class=""><blockquote type="cite"><div>On 29 Dec 2015, at 22:44, Julien ROBIN <<a href="mailto:julien.robin28@free.fr" target="_blank">julien.robin28@free.fr</a>> wrote:</div><br><div><div>Hi,<br><br>In fact, this is strange because Upload means that the server is receiving something to send, idem for Downloads : upload and download should be the same if the Tor Process is used as server only (relay or exit).<br></div></div></blockquote><div><br></div></span><div>Yes, you're right, my original email was mistaken - any uploads or downloads go in via tor and out to the Internet (or vice versa).</div><div><br></div><div>The only things I can think of that could cause an increase in outbound traffic are:</div><div>* cell padding for many small internet server responses (up to 512x for a 1-byte response),</div><div>* becoming a hidden service directory for a popular hidden service,</div><div>* having a lot of clients download directory documents at once (this shouldn't happen, client directory downloads are randomised),</div><div>* having clients make lots of DNS requests via your exit (again, this shouldn't happen, DNS requests are limited size).</div><div><br></div><div>I don't know of any other attack or request that amplifies outbound traffic via tor or otherwise, but there may be some. Perhaps you could see what kind of traffic you are sending if it happens again. (It's hard to help without more information.)</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>Tim</div></font></span></div><span class=""><br><div>
<div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="text-align:start;text-indent:0px;word-wrap:break-word"><div style="color:rgb(0,0,0);letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px;text-align:start;text-indent:0px;word-wrap:break-word">Tim Wilson-Brown (teor)</div><div style="color:rgb(0,0,0);letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px;text-align:start;text-indent:0px;word-wrap:break-word"><br></div><div style="text-align:start;text-indent:0px;word-wrap:break-word">teor2345 at gmail dot com<br>PGP 968F094B<br><br>teor at blah dot im<br>OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F</div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>
<br></span></div><br>_______________________________________________<br>
tor-relays mailing list<br>
<a href="mailto:tor-relays@lists.torproject.org">tor-relays@lists.torproject.org</a><br>
<a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays" rel="noreferrer" target="_blank">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br>
<br></blockquote></div><br></div>