<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div></div><div><br></div><div>On 17 Feb 2018, at 07:21, Matt Traudt <<a href="mailto:pastly@torproject.org">pastly@torproject.org</a>> wrote:<br><br></div><blockquote type="cite"><div><blockquote type="cite" __apple_fixed_attribute="true"><span>On 2/16/18 12:23, nusenu wrote:</span><br></blockquote><blockquote type="cite"><span>I was wondering if these unfriendly tor clients are using tor's default</span><br></blockquote><blockquote type="cite"><span>path selection or something else.</span></blockquote></div></blockquote><div><br></div><div>We think they are using Tor's bandwidth weights, but without entry guards.</div><div>They may be using one of the buggy versions that assigns exits a non-zero</div><div>weight.</div><br><blockquote type="cite"><div><blockquote type="cite"><span>If they do tor exit relays would have much smaller values in their DoS stats, right?</span></blockquote></div></blockquote><div><br></div><div>My exit has smaller DoS stats and connections than my guards.</div><div>And my higher-weighted guards have more connections than my</div><div>lower-weighted guards.</div><div><br></div><div>These DoS stats are from one of my guards:</div><div><a href="https://trac.torproject.org/projects/tor/ticket/24902#comment:76">https://trac.torproject.org/projects/tor/ticket/24902#comment:76</a></div><div><br></div><blockquote type="cite"><div><blockquote type="cite"><span>Would any tor exit operator (listed bellow) running 0.3.3.2-alpha be willing to share (obfuscated/not exact</span><br></blockquote><blockquote type="cite"><span>counters) of their DoS log entries? (only if you do not have any additional firewall rules filtering packets)</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><span></span><br><span>I run an 0332-alpha relay with no extra firewall rules.</span><br><span></span><br><span>4B084AD6A0BA70761A333829F52042BB6EA009AF</span><br><span></span><br><span>In case the following gets wrapped and ruined: <span><a href="https://paste.debian.net/1010648/">https://paste.debian.net/1010648/</a></span></span><br><span></span><br><span>Feb 16 01:50:55.000 [notice] Since startup, we have initiated x v1 connections, x v2 connections, x v3 connections, and 5xxxx v4 connections; and received 5x v1 connections, 1xx v2 connections, 9xx v3 connections, and 4xxxxx v4 connections.</span><br><span>Feb 16 01:50:55.000 [notice] DoS mitigation since startup: x circuits rejected, x marked addresses. x connections closed. 2xx single hop clients refused.</span><br></div></blockquote><div><br></div><div>On my guards, each of these figures is much higher.</div><div><br></div><div>But the "<span style="background-color: rgba(255, 255, 255, 0);">single hop clients refused" figure is proportional to the bandwidth</span></div><div><span style="background-color: rgba(255, 255, 255, 0);">(my figure is 8x, and my bandwidth is 5x). So those clients may be using</span></div><div><span style="background-color: rgba(255, 255, 255, 0);">raw bandwidth weights rather than middle weights.</span></div><div><span style="background-color: rgba(255, 255, 255, 0);"><br></span></div><div><span style="background-color: rgba(255, 255, 255, 0);">T</span></div></body></html>