<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
</head>
<body>
<div style="font-family:sans-serif"><div style="white-space:normal"><p dir="auto">All,</p>
<p dir="auto">Just adding 0.02c; from the hosts going above 24 connections (my FW limit), the ASN's involved seem to focus on:<br>
5 LEASEWEB-USA-WDC-01 - Leaseweb USA, Inc., US<br>
18 OVH, FR<br>
25 LEASEWEB-NL-AMS-01 Netherlands, NL</p>
<p dir="auto">That's 48 from the 72 IP's exhibiting this behaviour. Whereby the leaseweb ones are consecutive IP's.</p>
<p dir="auto">Careful not to share IP's here :-)</p>
<p dir="auto">All seen from the perspective of SJC01 / 328E54981C6DDD7D89B89E418724A4A7881E3192</p>
<p dir="auto">Stijn</p>
<p dir="auto">On 22 Dec 2017, at 16:49, Pascal Terjan wrote:</p>
<blockquote style="border-left:2px solid #777; color:#777; margin:0 0 5px; padding-left:5px"><p dir="auto">I got also 17 from ovh (under ip-54-36-51.eu) and plenty of<br>
leaseweb.com (didn't count) too but no your-server.de<br>
<br>
The OVH ones were interestingly 2 (nearby) consecutive blocks of 4 and<br>
13 IPs (and are not relays)<br>
<br>
<br>
On 22 December 2017 at 15:23, Tyler Johnson <tylrcjhnsn@gmail.com> wrote:</p>
<blockquote style="border-left:2px solid #777; color:#999; margin:0 0 5px; padding-left:5px; border-left-color:#999"><p dir="auto">Every IP I was checking through Atlas which are part of the mentioned hosts<br>
were NOT relays, all client connections.<br>
<br>
On Dec 22, 2017 9:20 AM, "niftybunny" <abuse@to-surf-and-protect.net> wrote:</p>
<blockquote style="border-left:2px solid #777; color:#BBB; margin:0 0 5px; padding-left:5px; border-left-color:#BBB"><p dir="auto">Thats “only” “relays” with multiple connections to your relay?<br>
Interesting to see Hetzner there …<br>
<br>
Markus<br>
<br>
<br>
On 22. Dec 2017, at 16:14, Tyler Johnson <tylrcjhnsn@gmail.com> wrote:<br>
<br>
Out off 133 IPs blocked with my rather aggressive firewall ruleset:<br>
<br>
leaseweb.com - 26<br>
your-server.de - 66<br>
ip-54-36-51.eu - 17<br>
<br>
That was in < 24hrs.<br>
<br>
On Dec 22, 2017 3:38 AM, "niftybunny" <abuse@to-surf-and-protect.net><br>
wrote:</p>
<blockquote style="border-left:2px solid #777; color:#BBB; margin:0 0 5px; padding-left:5px; border-left-color:#BBB"><p dir="auto">Short answer:<br>
<br>
<a href="https://i.imgur.com/8QLptcz.png" style="color:#BBB">https://i.imgur.com/8QLptcz.png</a><br>
<br>
Around 15000 - 18000 connections I can see with netstat. Even my 300 mbit<br>
exit has less and there a a lot of Leaseweb clients connecting to me ...<br>
The interesting thing is, it comes and goes in waves. From 6000 (normal)<br>
to 20000 connections within an hour.<br>
Someone doesn't like me very much :(<br>
<br>
Markus<br>
<br>
<br>
<br>
On 22. Dec 2017, at 08:42, Felix <zwiebel@quantentunnel.de> wrote:<br>
<br>
Am 22-Dec-17 um 08:25 schrieb niftybunny:<br>
<br>
Still under heavy attack even with the MaxMemInQueues and 0.3.2.8-rc. I<br>
need 2 xeons to push 30 mbit as a guard/middle …<br>
<br>
<br>
Do you want to share some information:<br>
<br>
Type i)<br>
(memory exhaustion by too many circuits)<br>
What is the memory(top) per tor and its MaxMemInQueues ?<br>
How many circuits per hour in log ?<br>
<br>
Type ii)<br>
(cpu exhaustion by too many 'half open' tor connections)<br>
Is your number of open files normal (fw in place) and moderate<br>
connection counts per remote IP ?<br>
<br>
Type iii)<br>
(One fills your server with too many long fat pipes, first ACK and RTT)<br>
If on Freebsd, is "mbuf clusters in use" (netstat -m) moderate ?<br>
Do you get "kern.ipc.nmbclusters limit reached" in messages ?<br>
<br>
--<br>
Cheers, Felix</p>
</blockquote></blockquote></blockquote></blockquote></div>
</div>
</body>
</html>