July 2013 - tor-relays - lists.torproject.org

Tor exit node flags explanation
by Bernard Tyers - ei8fdb 26 Jul '13

26 Jul '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I have looked thru FAQs and docs but can't find an answer (no doubt its in front of me somewhere). Is there any explanation of what Tor node flags mean? Specifically the "Named" flag. It has recently been applied to my node. thanks, Bernard - -------------------------------------- Bernard / bluboxthief / ei8fdb IO91XM / www.ei8fdb.org -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJR8nm1AAoJENsz1IO7MIrrxjQIAIRB/Y+a0fyQvcA/b/3+PuT8 spVgrS6Ts39w0xncwO1DCcCDzA1EmEaQy2I6VZ1YYIk+qrDXSkyP8Gl2ACWJ8SZi Wjmt9OeQZYE3thUfXlEX4K0iqiu1vc26dHxR0VAwqV9a4GAFJ6vmDiwNLqhjEjVA a/uQdNwx1kPfApHMIDRRmBFRWGJ5v//3XxN1nS7Ty5q2ngR7ws9xfRJ6awpRrYFN vRpHPG/BGQGbcCsBsecGu/nSJaN+2mfqb9fRaHIeDUBtn6xV465BxmhZwCzf2sL4 jYoMnLByJodfImhT53qPBlgs/7HNuMbFldeREI21QlWEVi4eaN9BLS2/fe+rLQA= =R/y8 -----END PGP SIGNATURE-----

2 1

Yet another underpowered relay?
by Logforme 23 Jul '13

23 Jul '13

I recently upgraded from an adsl line to a 100mbit fiber connection. Naturally I want to use most of this new bandwidth for my non-exit tor relay. However, I run into messages like these: Jul 22 17:40:26.000 [warn] Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [665 similar message(s) suppressed in last 60 seconds] Jul 22 17:40:26.000 [warn] Failed to hand off onionskin. Closing. [1509 similar message(s) suppressed in last 21600 seconds] Relay fingerprint: BE71 DC9D A443 5855 FAE1 E369 7080 1A60 0D51 3684 Relevant torrc settings: BandwidthRate 10 MB BandwidthBurst 10 MB NumCPUs 2 I did some research and came up with the following things to try: Set "MaxAdvertisedBandwidth x MB" Set "MaxOnionsPending 250" Get a faster computer / Get a computer with AES-NI I tried setting "MaxAdvertisedBandwidth 9 MB" for a few days which didn't seem to do much difference. This is only a 1MB reduction from the 10MB i use as a hard limit. Too little? Must I wait longer for the change to get spread around? Setting "MaxOnionsPending 250" seem to have reduced the number of log messages, but not eliminated them. The computer is somewhat dated but not ancient: Intel(R) Core(TM) i7 CPU 930 @ 2.80GHz, 4 cores with HT, 6GB mem. I feel it should be able to handle a 80 mbit bandwidth but have no hard data to support this. Looking at htop tor uses 2 cores. One core is constantly at around 90% (when all the 80 mbit bandwidth is used). The second core is hardly used. Since the relay can handle 80mbit (and higher) without messages I assume the problems only occur when the number of circuits get very high. Questions: What value should I set for MaxAdvertisedBandwidth? What other torrc settings could improve the situation? Am I wrong in thinking my cpu should be able to handle 80 mbit? Would upgrading to 0.2.4.15-rc-1 help? Weird sidenote: If I start iftop the first core drops to around 40-50%. Stop iftop and it jumps back to 90%. No change in traffic. What could that mean?

4 4

Re: [tor-relays] Exit relay operators: a call for packets on port 8118
by rotpoison throngnet 22 Jul '13

22 Jul '13

I believe you are exactly right, Javntea. Thank you for the insight. I opened up Privoxy for a few seconds on my node (below) and had similar results. I had no idea that pay for click advertisers would even accept referrals from Tor. It is pretty basic to filter identified exit relays and other anonymous proxies. So apparently the return of investment from this sort of clickfraud pays the leasing bills of thousands of servers? WoW, I have been schooled... - Kent 09:21:01.419951 IP 23.19.89.126.2318 > my.exit.node.8118: Flags [P.], seq 1:416, ack 1, win 65535, length 415 E.....@.u.u/..Y~B... ...^.]^M....P.......GET http://ad.media-servers.net/st?ad_type=iframe&ad_size=160x600&section=44321… Accept: */* Referer: http://giftcardsrus.net/index.php?option=com_content&view=article&id=1741:w… Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0) Host: ad.media-servers.net Connection: Keep-Alive 09:21:01.419973 IP my.exit.node.8118 > 23.19.89.126.2318: Flags [.], ack 416, win 6432, length 0 E..(..@.@...B.....Y~.. .....^.^.P.. .k.. 09:21:01.420501 IP my.exit.node.8118 > 23.19.89.126.2318: Flags [P.], seq 1:256, ack 416, win 6432, length 255 E..'..@.@...B.....Y~.. .....^.^.P.. .j..HTTP/1.0 403 Request blocked by Privoxy Content-Type: image/png Content-Length: 102 Cache-Control: no-cache Date: Mon, 22 Jul 2013 09:21:01 GMT Last-Modified: Wed, 08 Jun 1955 12:00:00 GMT Expires: Sat, 17 Jun 2000 12:00:00 GMT Pragma: no-cache 09:21:01.430712 IP 173.208.16.93.1094 > my.exit.node.8118: Flags [.], ack 1, win 65535, length 0 E..(...........]B....F...._..x..P....~........ 09:21:01.431701 IP 173.208.16.93.1094 > my.exit.node.8118: Flags [P.], seq 1:511, ack 1, win 65535, length 510 E..&...........]B....F...._..x..P.......GET http://ad.globe7.com/st?ad_type=pop&ad_size=0x0&section=3910946&banned_pop_… Accept: */* Referer: http://twicemagic.com/index.php?option=com_content&view=category&layout=blo… Accept-Language: en-us User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; Media Center PC 6.0; InfoPath.3; MS-RTC LM 8; Zune 4.7) Host: ad.globe7.com Connection: Keep-Alive 09:21:01.431722 IP my.exit.node.8118 > 173.208.16.93.1094: Flags [.], ack 511, win 6432, length 0 E..(..@.@.b.B......]...F.x....a.P.. .... 09:21:01.432462 IP my.exit.node.8118 > 173.208.16.93.1094: Flags [P.], seq 1:256, ack 511, win 6432, length 255 E..'..@.@.a.B......]...F.x....a.P.. ....HTTP/1.0 403 Request blocked by Privoxy Content-Type: image/png Content-Length: 102 Cache-Control: no-cache Message: 3 Date: Mon, 22 Jul 2013 00:09:55 -0700 (PDT) From: Javantea <jvoss(a)altsci.com> To: tor-relays(a)lists.torproject.org Subject: Re: [tor-relays] Exit relay operators: a call for packets on port 8118 Message-ID: <20130722070955.1CF571380F1(a)mail.altsci.com> Content-Type: text/plain; charset="us-ascii" Hi Kent, I am getting 125 packets per second sustained incoming on port 8118 like you on my exit node. I noticed this last year but forgot about it because it was such low bandwidth. I count 2582 unique IPs in 20 minutes. I think you've found something significant. The obvious question is why since sending data in the clear is pretty worthless and it's going to come out of a tor exit node just like if they were using tor. I'm a security researcher and would be happy to help you learn more about these silly systems. You've already done most of the basic research though: who, what, and where. When I open port 8118 with netcat a few times I get this: GET http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=421110… HTTP/1.0 Accept: */* Referer: http://www.lotsoffree.com/index.php?option=com_content&view=article&id=84:f… Accept-Language: en-us User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.3) Gecko/2008092417 Firefox/3.0.3 Host: ad.yieldmanager.com Connection: Keep-Alive GET http://ib.adnxs.com/ttj?id=1284883 HTTP/1.0 Accept: */* Referer: http://www.psxobs.com/privacy-policy Accept-Language: en-us User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:5.0) Gecko/20100101 Firefox/5.0 Host: ib.adnxs.com Connection: Keep-Alive That looks like clickfraud to me. Perhaps someone wrote a quick script that downloads the list of tor exit nodes and sends clickfraud requests to 8118 and was too lazy to add tor. That would mean that the sites in the referrer are the attackers and the url on the first line is the ad service which is being defrauded. Of course there is the possibility of a joe job occuring, but we know that at least some of them are the bad actors. Whois on both referrers returns China. I'm surprised that the script doesn't remove servers from the list that have the port closed. It's a very inefficient script. Regards, Javantea

1 0

relay uptime
by l3thal 22 Jul '13

22 Jul '13

Hi, I recently edited my torrc and accidentally did restart instead of reload so my uptime was reset. Will this negatively impact the 60 days to get a tshirt? -- l3thal - SmashTheStack <http://smashthestack.org>

2 2

Checking my Tor bridge and adventage of dynamic ip addresses
by nobleeightfoldpath＠lavabit.com 20 Jul '13

20 Jul '13

Hi list members, Iam kinda new to Tor and decided to run a relay and found heavy traffic on my router. No prob, but after reading the documentation and some discussion boards I decided to make internet access possible for people living in censorship and run a bridge on Linux without Vidalia and other x related apps. I use "Arm" to check the Tor daemon activities. The bridge runs a few days and I see: flags: no, and there is nearly zero traffic, avg 1.4 Kbs, mostly 0. Arm displays connections and I see some IP addresses, 2 circuits. And often just - nothing. Obviously Tor is running, but Iam afraid that my config isn't useful... How can I check my bridge is really working? Another question comes up. I use a cable connection to my ISP and they don't change my IP address, until plugging off my modem and wait an hour... I think if my bridge IP address is some day on some black lists, it could be an adventage if my IP address changes, right? If so, what changing time is fine, every day? Regards

5 8

Bandwidth Spike
by Bryan Carey 19 Jul '13

19 Jul '13

I'm a fairly new Tor relay operator and noticed something peculiar with my bandwidth for the relay recently. It seems to have jumped WAY up and just plateaued at what I have the peak bandwidth limit set at. Is there any kind of explanation for this? Is this normal behavior? Could it indicate some kind of denial of service attack? Here's a screenshot I took of the bandwidth history: https://i.imgur.com/mRyKp9L.jpg (note that both R/W plateau at the same point in time) Perhaps this is normal behavior but I want to know if it's something that might be messed up with my configuration that I can correct. -Bryan

2 1

hardware
by Andreas Fink 15 Jul '13

15 Jul '13

can someone give me hints on what hardware would be best suited to run big fat tor exit nodes connected with multiple 1gbps or 10gps links? We are considering putting some fat boxes near major internet exchanges of the world. sent from iPhone

5 6

TCP: Peer unexpectedly shrunk window
by krishna e bera 15 Jul '13

15 Jul '13

Are such messages something to worry about? What do they mean? Example from dmesg log: [422949.356062] TCP: Peer 79.22.114.39:60467/9001 unexpectedly shrunk window 2565384113:2565389251 (repaired) [427073.032013] TCP: Peer 217.20.253.198:17482/9001 unexpectedly shrunk window 2017146666:2017147597 (repaired) [478256.668534] TCP: Peer 2.236.7.28:49367/9001 unexpectedly shrunk window 176191274:176194194 (repaired) [502615.724129] TCP: Peer 217.20.253.198:53308/9001 unexpectedly shrunk window 792267503:792268436 (repaired) [514591.656053] TCP: Peer 217.20.253.198:63743/9001 unexpectedly shrunk window 445257517:445258452 (repaired) [527753.064036] TCP: Peer 94.38.5.188:49377/9001 unexpectedly shrunk window 2291195973:2291197433 (repaired) [633078.304041] TCP: Peer 87.89.75.107:59567/9001 unexpectedly shrunk window 3718547610:3718553466 (repaired) [633079.672021] TCP: Peer 87.89.75.107:59567/9001 unexpectedly shrunk window 3718547610:3718553466 (repaired) [673170.600037] TCP: Peer 82.89.173.120:50392/9001 unexpectedly shrunk window 2473022599:2473024051 (repaired) [714540.672036] TCP: Peer 217.20.253.198:20805/9001 unexpectedly shrunk window 3814426018:3814426947 (repaired) [755391.792076] TCP: Peer 79.223.168.103:61238/9001 unexpectedly shrunk window 2799388466:2799406672 (repaired) [755392.864013] TCP: Peer 79.223.168.103:61238/9001 unexpectedly shrunk window 2799388466:2799406672 (repaired)

3 2

Why doesn't my Tor Relay (non-exit) show an Onion Key
by gongeek＠gmail.com 15 Jul '13

15 Jul '13

When i check my running tor relay (Fingerprint: $66a81cecd3aef6999982c5abee1942e3e5ab3b1c ) on this site<https://torstatus.blutmagie.de/router_detail.php?FP=66a81cecd3aef6999982c5a…>i notice that the "Onion Key" field (located near bottom of the page) is empty. My relay has been running for over 24 hours and i still dont see anything in that field. I tested out my relay as an EntryNode and i was able to access the internet through tor fine. I have watched the Bandwidth Graph and seen other users use my Relay so it is running fine. But i cant understand why my Onion Key field is empty. When i check other relays on the site (every relay i've checked) has an Onion Key displayed including relays that have just started running less than 10 mins ago. You can see all the relays here <https://torstatus.blutmagie.de/>. Click any and of the displayed relays and notice each has a displayed Onion Key -- except my relay. Any info on why this is would be great Thanks

2 1

Final Warning Notice
by Chris Sheats 11 Jul '13

11 Jul '13

Hey tor-relays, The past few months, since I upgraded my net connection to 1Gbps, I've hit the top 40 fastest relays and the top 20 fastest exit nodes, peaking to over 17 MB/s. I've always prided the fact that my ISP, CondoInternet in Seattle, has been very welcoming of my reduced exit node. In the past, the malicious activity hasn't been "too much" for my ISP--examples here: http://yawnbox.com/1461--but now they want me to shut it down. What are my options? Forwarded email: Final Warning Notice - IP address 216.243.58.198 I am writing you regarding the repeated abuse complaints that we're receiving for your IP allocation. While we at CondoInternet are all for an open and unmolested with Internet experience for our customers as it was one of our founders' primary reasons for starting CondoInternet, your Tor node has generated a disproportional amount of abuse and legal complaints compared to the rest of our customers. We are asking that you remove the Tor node from your CondoInternet connection or to please switch to an alternative service provider by July 15th 2013. We very much appreciate you being part of the CondoInternet family and do apologize for any inconvenience this change may cause you. Please feel free to contact me directly if you have any questions. Sincerely, Operations Manager CondoInternet -- Chris Sheats yawnbox(a)gmail.com

7 9