<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">No clue what they are doing, but they max out the Exist with 100% CPU load and do not transport a lot of traffic:<div class=""><br class=""></div><div class=""><a href="https://imgur.com/a/NzpE69B" class="">https://imgur.com/a/NzpE69B</a></div><div class=""><br class=""></div><div class="">Around 16-21 there should be more traffic and this was DDOS time.</div><div class=""><br class=""></div><div class="">I am 100% sure its not bogus traffic just send to my IPs to max out my uplinks, because: </div><div class=""><br class=""></div><div class=""><a href="https://www.peeringdb.com/net/22652" class="">https://www.peeringdb.com/net/22652</a></div><div class=""><br class=""></div><div class="">you need at least 120 gigabit to kill my uplinks.</div><div class=""><br class=""></div><div class="">I love dull, I love dull sooooo much. I want to marry dull.</div><div class=""><br class=""></div><div class="">nifty</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 25. Aug 2020, at 21:20, Roger Dingledine <<a href="mailto:arma@torproject.org" class="">arma@torproject.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On Tue, Aug 25, 2020 at 06:49:01PM +0000, John Ricketts wrote:<br class=""><blockquote type="cite" class="">I as well.<br class=""><br class="">On Aug 25, 2020, at 13:45, niftybunny <<a href="mailto:abuse-contact@to-surf-and-protect.net" class="">abuse-contact@to-surf-and-protect.net</a>> wrote:<br class=""><br class="">?Daily DDOS love the last 14 days ...<br class=""></blockquote><br class="">Hi! Can you provide more details? From Nifty's picture it looks like<br class="">they are full TCP connections? Do you have a sense of what do they do<br class="">when they connect?<br class=""><br class="">And that would mean that they *aren't* packet-level ddoses, i.e. the<br class="">"I fill up your network connection with packets so no other packets can<br class="">get through" kind?<br class=""><br class="">One of the strange things about working with things at the scale of the<br class="">Tor network is that sometimes the combined behavior of many Tor processes<br class="">can look like a DDoS. For example, maybe all of these connections come<br class="">from out-of-date Tors that are now behaving bizarrely since the network<br class="">now doesn't work the way their old logic expects.<br class=""><br class="">We've also seen what looks like DDoS attempts on the directory<br class="">authorities, but on closer examination they are some alternative Tor<br class="">implementation that is running on many thousands of computers and is<br class="">fetching Tor consensus documents in a way that isn't sustainable:<br class=""><a href="https://gitlab.torproject.org/tpo/core/tor/-/issues/33018" class="">https://gitlab.torproject.org/tpo/core/tor/-/issues/33018</a><br class=""><br class="">There are also apparently some overloading attacks happening on some<br class="">popular onion services currently, and I wonder if those are bleeding<br class="">over into looking like many connections. Or, as we saw a few years ago<br class="">when we added the "ddos defense subsystem" in Tor, the attacks didn't<br class="">actually add much load, but it was when the onion services tried to scale<br class="">up to tens of thousands of Tors, to be able to respond to every incoming<br class="">rendezvous attempt, that those tens of thousands of Tors together looked<br class="">like an attack on the network.<br class=""><br class="">So: the next step would be to try to learn more about what these<br class="">connections look like, where they're coming from, what they're doing, etc.<br class=""><br class="">Also, if more people than just Nifty and John are seeing them.<br class=""><br class="">Never a dull moment,<br class="">--Roger<br class=""><br class="">_______________________________________________<br class="">tor-relays mailing list<br class="">tor-relays@lists.torproject.org<br class="">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays<br class=""></div></div></blockquote></div><br class=""></div></body></html>