<div dir="ltr">Hi,<div><br></div><div>We're experiencing what looks like a DoS attack on multiple relays in our family:</div><div><br></div><div><a href="https://atlas.torproject.org/#search/family:CBEAE10CBBB86C51059246B2EF92EB2CB4E111BC">https://atlas.torproject.org/#search/family:CBEAE10CBBB86C51059246B2EF92EB2CB4E111BC</a><br></div><div><br></div><div>The relays are currently running Tor 0.3.1.9 on Linux kernel 4.4.0 (although when the problem started the relays were running Tor 0.3.1.8).</div><div><br></div><div>The attack knocked 3 of 6 relays offline overnight. By the time we looked at logs, the Tor service had stopped and this was the last line in the log:</div><div><br></div><div>"Tor[xyz]: Failing because we have 16351 connections already. Please read doc/TUNING for guidance."</div><div><br></div><div>The attack is still ongoing. When it's happening, the number of connections rises very rapidly, until the attack succeeds in stopping the service.</div><div><br></div><div><div>$ ss -s</div><div>Total: 15855 (kernel 0)</div><div>TCP: 24520 (estab 23969, closed 305, orphaned 31, synrecv 0, timewait 261/0), ports 0</div><div><br></div><div>Transport Total IP IPv6</div><div>*<span style="white-space:pre"> </span> 0 - - </div><div>RAW<span style="white-space:pre"> </span> 0 0 0 </div><div>UDP<span style="white-space:pre"> </span> 8 4 4 </div><div>TCP<span style="white-space:pre"> </span> 24215 24213 2 </div><div>INET<span style="white-space:pre"> </span> 24223 24217 6 </div><div>FRAG<span style="white-space:pre"> </span> 0 0 0 </div><div><br></div><div>... and only a few seconds later:</div><div><br></div><div>$ ss -s</div><div>Total: 12120 (kernel 0)</div><div>TCP: 27389 (estab 20026, closed 1906, orphaned 45, synrecv 0, timewait 1587/0), ports 0</div><div><br></div><div>Transport Total IP IPv6</div><div>*<span style="white-space:pre"> </span> 0 - - </div><div>RAW<span style="white-space:pre"> </span> 0 0 0 </div><div>UDP<span style="white-space:pre"> </span> 8 4 4 </div><div>TCP<span style="white-space:pre"> </span> 25483 25481 2 </div><div>INET<span style="white-space:pre"> </span> 25491 25485 6 </div><div>FRAG<span style="white-space:pre"> </span> 0 0 0 </div></div><div><br></div><div>That's obviously much larger than the normal number of connections, more than we've ever seen, and seems like more connections than would be needed for a relay.</div><div><br></div><div>We have file descriptors (/proc/sys/fs/file-max) set to 64000, but it looks like Tor sets MAX_FILEDESCRIPTORS to 16384 per /etc/init.d/tor:</div><div><br></div><div> elif [ "$system_max" -gt "40000" ] ; then</div><div> MAX_FILEDESCRIPTORS=16384</div><div><br></div><div>Surely that is high enough for normal service?</div><div><br></div><div>We haven't started looking into where the traffic is coming from or other characteristics. We are wondering if: 1) this is a known attack, 2) if other operators are experiencing it, 3) if there are any ideas for mitigating it, and 4) if any additional information would be helpful.</div><div><br></div><div>Thanks.</div><div><br></div>
</div>