<div>Hi Scott,</div><div><br></div><div>Got a couple of questions.</div><div><br></div><div>- Have you looked deeper into the request for port 43, using tcpdump or Wireshark? </div><div>- Do you KNOW that it is a WHOIS request, not OpenVPN or something else running on the WHOIS port? </div>
<div>- Have you logged what IP's are being connected to? </div><div><br></div><div>I just curious, as this seems to be really odd to me that so many WHOIS request are going through Tor.</div><div>I'm almost curious enough to run a exit node now just to see what might be going on.</div>
<div><br></div><div>- Kyle</div><div><br></div><div><br><div class="gmail_quote">On Fri, Jun 12, 2009 at 12:29 AM, Scott Bennett <span dir="ltr"><<a href="mailto:bennett@cs.niu.edu">bennett@cs.niu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"> A bit over a month ago, I posted here some exit statistics by port number.<br>
One major oddity among them was the count of port 43 (whois) exits, which<br>
seemed extraordinarily large, especially in relation to the counts for other,<br>
more expectedly popular port numbers. Some of the comments I got in response<br>
gave me an idea. In the what follows here, keep in mind that the second most<br>
frequently occurring exit port number in the statistics previously reported<br>
was 443 (https), and that the count of port 43 exits was in the millions when<br>
the count of port 443 exits was several hundred thousand. It is important to<br>
note that my node's exit policy regarding port 80 (http) is highly restrictive,<br>
resulting in very low exit counts for that port. Keeping that in mind, the<br>
exit counts for almost all other ports were not and are not similarly<br>
restricted.<br>
I replaced the "ExitPolicy accept *:43" in my torrc file with the<br>
following:<br>
<br>
###---Limited list of allowed whois exit addresses<br>
ExitPolicy accept <a href="http://192.103.19.12:43" target="_blank">192.103.19.12:43</a> # whois access to <a href="http://whois.6bone.net" target="_blank">whois.6bone.net</a><br>
ExitPolicy accept <a href="http://192.149.252.44:43" target="_blank">192.149.252.44:43</a> # whois access to <a href="http://whois.arin.net" target="_blank">whois.arin.net</a><br>
ExitPolicy accept <a href="http://193.0.0.135:43" target="_blank">193.0.0.135:43</a> # whois access to <a href="http://whois.ripe.net" target="_blank">whois.ripe.net</a><br>
ExitPolicy accept <a href="http://194.85.119.77:43" target="_blank">194.85.119.77:43</a> # whois access to <a href="http://whois.ripn.net" target="_blank">whois.ripn.net</a><br>
ExitPolicy accept <a href="http://196.216.2.1:43" target="_blank">196.216.2.1:43</a> # whois access to <a href="http://whois.afrinic.net" target="_blank">whois.afrinic.net</a><br>
ExitPolicy accept <a href="http://198.108.0.18:43" target="_blank">198.108.0.18:43</a> # whois access to whois.ra{,db}.net<br>
ExitPolicy accept <a href="http://199.7.51.74:43" target="_blank">199.7.51.74:43</a> # whois access to <a href="http://whois.crsnic.net" target="_blank">whois.crsnic.net</a><br>
ExitPolicy accept <a href="http://199.7.55.74:43" target="_blank">199.7.55.74:43</a> # whois access to <a href="http://whois.internic.net" target="_blank">whois.internic.net</a><br>
ExitPolicy accept <a href="http://199.43.0.144:43" target="_blank">199.43.0.144:43</a> # whois access to <a href="http://whois.arin.net" target="_blank">whois.arin.net</a><br>
ExitPolicy accept <a href="http://200.160.2.3:43" target="_blank">200.160.2.3:43</a> # whois access to <a href="http://whois.registro.br" target="_blank">whois.registro.br</a><br>
ExitPolicy accept <a href="http://200.160.2.15:43" target="_blank">200.160.2.15:43</a> # whois access to <a href="http://whois.lacnic.net" target="_blank">whois.lacnic.net</a><br>
ExitPolicy accept <a href="http://202.12.29.13:43" target="_blank">202.12.29.13:43</a> # whois access to <a href="http://whois.apnic.net" target="_blank">whois.apnic.net</a><br>
ExitPolicy accept <a href="http://202.30.50.120:43" target="_blank">202.30.50.120:43</a> # whois access to <a href="http://whois.krnic.net" target="_blank">whois.krnic.net</a><br>
ExitPolicy accept <a href="http://205.178.188.12:43" target="_blank">205.178.188.12:43</a> # whois access to <a href="http://whois.networksolutions.com" target="_blank">whois.networksolutions.com</a><br>
ExitPolicy accept <a href="http://206.51.224.229:43" target="_blank">206.51.224.229:43</a> # whois access to <a href="http://whois.nic.gov" target="_blank">whois.nic.gov</a><br>
ExitPolicy accept <a href="http://208.77.188.18:43" target="_blank">208.77.188.18:43</a> # whois access to <a href="http://whois.icann.org" target="_blank">whois.icann.org</a><br>
ExitPolicy accept <a href="http://208.77.188.87:43" target="_blank">208.77.188.87:43</a> # whois access to <a href="http://whois.iana.org" target="_blank">whois.iana.org</a><br>
ExitPolicy reject *:43 # nicname whois<br>
###---End of whois exit policy specifications<br>
<br>
The relationship now between the exit counts for ports 43 and 443 in the<br>
last few days since I switched to 0.2.1.15-rc with Nick's patch applied looks<br>
like this:<br>
<br>
439 Exit to port 43<br>
72052 Exit to port 443<br>
<br>
In other words, by restricting just port 43 exits to only the legitimate whois<br>
IP addresses, I eliminated at least 70% of *all* exits through my tor node,<br>
which suggests to me that the vast, overwhelming majority of exits from the<br>
tor network are illegitimate and place a terribly taxing load upon the tor<br>
network as a whole. This apparent fact, in turn, suggests that if a) all<br>
tor nodes with an explicit exit policy were to restrict port 443 exits to<br>
just the legitimate port 43 IP addresses and b) the tor default exit policy<br>
did the same, a huge and illegitimate load would be lifted from the tor network<br>
overall. If no relays offer exits to port 43 that don't go to the NICs' whois<br>
servers, well over half of all tor exits, which are illegitimate and<br>
undeserving of service in the first place, will be eliminated (not counting<br>
typical port 80 (http) traffic, of course).<br>
Because my node's exit policy for port 80 (http) is not wide open, it is<br>
hard for me to estimate the relative importance of bogus port 43 requests<br>
w.r.t. legitimate port 80 (http) requests. Because of my node's limited port<br>
80 exit policy, I would be *very* interested in seeing exit counts for nodes<br>
with unrestricted exit policies for the combination of ports 43, 80, and 443<br>
in order to get a better idea of their relative importances.<br>
Nevertheless, the impact of eliminating those exit opportunities can be<br>
expected to be quite significant in terms of performance of the network<br>
overall, particularly because circuits will not need to be built in the first<br>
place for such requests. If even a few relays continue to offer unrestricted<br>
exits for port 43, they will get so badly hammered by all the bogus exit<br>
requests that they will cease to be important to normal operations of the tor<br>
network until such time as they may modify their exit policies to be more in<br>
tune with valid use of the tor network, rather than use by some sort of port<br>
scanner or whatever junk software is currently consuming so much of the tor<br>
network's resources, except to the extent that such non-conforming nodes would<br>
be incurring the cost of the circuits to reach them for the exit service.<br>
Please note also that changing the default exit policy and most tor node's<br>
explicit exit policies to the above specification would not prevent tor exit<br>
node operators from adding other legitimate whois servers' IP addresses to<br>
their exit policies.<br>
Therefore, I encourage all tor exit node operators to make the above<br>
described change to the exit policies of their exit nodes. (Feel free to copy<br>
and paste.) I further suggest that the default exit policy for tor be modified<br>
in all future releases of both the stable and development branches of tor to<br>
have the exit policy for port 43 shown above, as modified from time to time as<br>
the NICs' whois server addresses may change.<br>
Comments are both welcome and encouraged.<br>
<br>
<br>
Scott Bennett, Comm. ASMELG, CFIAG<br>
**********************************************************************<br>
* Internet: bennett at <a href="http://cs.niu.edu" target="_blank">cs.niu.edu</a> *<br>
*--------------------------------------------------------------------*<br>
* "A well regulated and disciplined militia, is at all times a good *<br>
* objection to the introduction of that bane of all free governments *<br>
* -- a standing army." *<br>
* -- Gov. John Hancock, New York Journal, 28 January 1790 *<br>
**********************************************************************<br>
</blockquote></div><br></div>