On Tue, Mar 14, 2017 at 12:02:46AM +0000, Matthew Finkel wrote:
It's interesting that the bridge users count began increasing a few days after relay users began decreasing. Actually, I found which bridge is supporting these new users. I confirmed it isn't one of the default bridges.
{"version":"4.0", "relays_published":"2017-03-13 22:00:00", "relays":[ ], "bridges_published":"2017-03-13 20:57:29", "bridges":[ {"nickname":"Unnamed","hashed_fingerprint":"220B66EBF7625B31D3313491C0B888E488F2E66B","or_addresses":["10.64.118.173:56651"],"last_seen":"2017-03-13 20:57:29","first_seen":"2016-01-18 11:55:20","running":true,"flags":["Fast","HSDir","Running","Stable","V2Dir","Valid"],"last_restarted":"2017-03-09 06:48:03","advertised_bandwidth":2503701,"platform":"Tor 0.2.9.5-alpha on Linux","transports":["scramblesuit","obfs3","obfs4"]} ]}
https://onionoo.torproject.org/details?fingerprint=220B66EBF7625B31D3313491C... https://atlas.torproject.org/#details/3E0908F131AC417C48DDD835D78FB6887F4CD1...
Nice find. I think your second link (to atlas.torproject.org) is wrong, because it's pointing to LeifEricson, which is one of the default bridges. The right link should be: https://atlas.torproject.org/#details/220B66EBF7625B31D3313491C0B888E488F2E6...
The disparity in bytes read/written is interesting. The bridge has about 6× more written bytes than read bytes. That could lend support to the idea that the inflated statistics are caused by connections that are prematurely terminated.