November 2015 - tor-relays - lists.torproject.org

unlisted exit relay
by Green Dream 17 Nov '15

17 Nov '15

While visiting https://torstatus.blutmagie.de/ in Tor Browser, I noticed it wasn't detecting the exit node I was being routed through as a relay. Curious, I tried looking up the same IP in both Atlas and Globe, but neither knows of a relay at this IP. The IP of this exit is 104.156.228.115. What scenarios might cause this situation? As a Tor user, should I care? At the very least, it seems desirable to always be able to research the nodes you are using.

2 1

Tor exit node companion
by Eran Sandler 17 Nov '15

17 Nov '15

Hi guys, I had a thought about writing a small Tor exit node companion app. This would be a single executable that does 2 things: - Serve HTTP port 80 traffic on a specific host name and show the standard Tor web page for exit nodes - Serve port 25 (SMTP) and forwards abuse(a)mydomain.com to an address of your choosing Bonus points would be to make sure the HTTP requests serve the latest version of the Tor disclaimer page (so it will automatically take the latest and periodically check that its the latest). It will then replace the various parts (email of the operator etc). I can write it in Go so that its a single rather small executable so that the exit node will only need to run it instead of web server (nginx or something lighter) and an SMTP server (for those pesky automated posts that, like in the case of webiron, are also sent to abuse(a)mydomain.com based on the reserve DNS). Do you think it would be useful? I would sure be happy to run as little processes as possible. Eran

3 4

webiron requesting to block several /24 subnet
by yl 16 Nov '15

16 Nov '15

Hello, I received an abuse email today from my hoster (several emails from webiron in one email), typical automated abuse emails, not much information. However, they request, if the origin IP is a Tor exit, to block the full /24 subnet. As they also state, they will not provide the full IP of there customer and request to block the exit to the /24. Any thoughts on this? I don't like to block the whole /24, just because one idiot using one of the IPs is using some snake oil service like webiron, the collateral damage is to big in my eyes. All other IPs in the same range will be blocked as well. Why should I even care about blocking such IPs given by webiron? In my opinion the blocking is useless from my side and in the worst case the users of webiron will block my exit node IP. Would it be better for the tor network if I'd block the IPs? Is there any bad consequences if I don't for the Tor network? Let me know your thoughts. The services URL is https://www.webiron.com, don't need to go there, I didn't because such services are just useless. Better use fail2ban or something similar. Greeting yl

12 16

Limiting Bandwidth
by Billy Humphreys 11 Nov '15

11 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi all, does anyone know how to make a tor relay only use x bandwidth, then stop? I have a 1100GB/month max limit (100GB free) and I don't want it automatically suspending. Any ideas? Regards, Billy. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWQ8hDAAoJECGBE+89M6jOfSkQAJk/WtNbHWtDNZ+uBRVr6aCA 89OQ0xudFzz8oxWYkvgnEiSJFdHy+I5tzVVMjVGGl2dXOWN1QB4irWXkQ0xtE5bi 8t27YsWCNT71CMvvBhbeVEU8KMTwnRaW/pnpdbSY3082DljORLpioK+N4R3fyyXR F6xFmPZQtw4X2SruZNZX3TzPjgKuL7p3VTE6WEP9t/A0G3zX+yNi7A5jNSpwVak2 TMMlvQglgoM5TY/HHInXHS4tNPIBhORGNJoGw2mf+fFk6O/LgOnfNRt4FjaHZqBO NNQKtNicaJgqR5hC7+xojog/3quB7WvvqDtzfoJa3VGqtILMM7y3MKx0R81DzZ3l zOsUguYDpjUkxqd/QWdwtmzMeDB5yjh91QCFFfdR56D6bIedWjubYBLUDEXHchSH bstdWTD5ZAePYFgp//hnH2gX5D8X/cC1Kho0S8FLf9uuKKI4Bdmt0UaPmZW8rn2M nf6zIQB7vPLWY/RbA2/tJq1TB2w1JDMtn911uheCrX6H3OiTXLrxTjBz3yTyCzYM Oag6Jpv/991Ir56cBzS8jOHi7Vxr56QuW2S/Cgae8yewJy4St7ISah19dtIU1PGB 66rwK2MmQJ3DynhMqfkompsQNfvugXiC+KXqGoQH2zwAcI0vnsJAn4efpGLaoVcN V2Jcy26OnSvFlBLI3GVx =k9GQ -----END PGP SIGNATURE-----

3 3

TorFlow
by Kenneth Freeman 11 Nov '15

11 Nov '15

A gorgeous visualization of the Tor's data traffic. Feast your eyes! https://torflow.uncharted.software/

5 9

graphing 3 months of onionoo data (2015-08-01 - 2015-10-31)
by nusenu 10 Nov '15

10 Nov '15

Hi, here are a few graphs, that - unlike metrics.tpo - do not focus on relay count but consider CW fraction or exit/guard probabilities. OS share by CW fraction https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… I didn't known about Tor 0.2.8 until I saw this graph https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… ONLINE SAS taking over OVH SAS's position on the AS marked? https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… France hosts 1/3 of the network's guard capacity https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… and has become the biggest country when it comes to exit probability as well: https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn…

1 1

Is this bridge worth running?
by eliaz 10 Nov '15

10 Nov '15

I'm running a bridge in Tor Browser 5.0.4 on Win7x86; torrc is fine, and I'm connecting to circuits. However my mean written/read bandwidth is reported in globe to be in the hundreds/tens range. The advertised bandwidth also jumps around, from about 10 to 51 kB/s. And a previous run over five months of continuous running the written/read bytes reached 7K only once. Is this data telling me that the bridge is not carrying much traffic at all? Is there anything I can do to improve performance? And is there any way that I can get some idea of the actual traffic load?- eliaz

1 0

Exit relay seized by police
by Kevin Beranek 10 Nov '15

10 Nov '15

Is there a procedure I should follow if a relay has been seized by the police? Do DirAuths typically do something in cases where a relay is seized? I just got a message from NQHost stating that "We have received several police inquires and court order to seize your VPS. ". This affects relay A1E0245862C707F977DF0EC79257C49CD5DA99FE. Thanks, Kevin

10 21

interpreting extra-infos
by eliaz 09 Nov '15

09 Nov '15

Can anyone point me to a tutorial about how to read the extra-info output of CollecTor? I'm particularly interested in what bridge-ip-versions v4=0,v6=0 means and why bridge-ip-transports does not report the the pluggable transport proxies (obfs3, obfs4, etc.) for the bridge I'm running.

2 1

Wrong IP from faravahar again
by Pascal Terjan 09 Nov '15

09 Nov '15

Nov 04 17:06:00.000 [notice] Our IP Address has changed from 149.18.2.82 to 154.35.32.5; rebuilding descriptor (source: 154.35.175.225). Nov 04 17:08:55.000 [notice] Our IP Address has changed from 154.35.32.5 to 149.18.2.82; rebuilding descriptor (source: 154.35.175.225). 5.32.35.154.in-addr.arpa domain name pointer faravahar.rabbani.jp.

2 1