November 2026 - tor-relays - lists.torproject.org

Complete list of Tor Metrics keys
by forest 05 Nov '26

05 Nov '26

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. In order to analyze the ongoing DDoS attack, I'm collecting metrics data from my relays. It's a lot of data so I'm compressing it with zstd. I need a "dictionary" containing a typical metrics output in order to get a better compression ratio. The best I have comes from: curl -s 127.0.0.1:9035/metrics | sed 's/ [0-9]*$//' > dict This creates a decent dictionary with sensitive information (the actual sample values themselves) removed. But from what I understand, Tor only outputs metrics that are relevant, so a relay that doesn't also host an onion service will never have a line starting in "tor_hs_", for example. I'm looking for a sample containing all possible metrics strings, as if Tor did not remove entries that are unrelated to its current state. It doesn't seem like the source code contains anything like that in one easily-accessible location. Does anyone know where I can get this? Regarding the privacy issue of storing metrics data, the relay will be automatically encrypting it with a public key so the relay itself never retains more than a few minutes worth of sensitive data in memory. The metrics will only be used to try to learn more about the ongoing DDoS. Regards, forest -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCaqTkCQAKCRAw+TRLM+X4 xokFAP4snthWGiMg8KXz318kibVVyBZhUIBlOUhVAaC4SuG2NwD/ZQThLAMQFUxP mAm6PbE68Hk91vvxQq9cr6ySYwjlCwc= =ck/7 -----END PGP SIGNATURE-----

2 2

Using MaxAdvertisedBandwidth instead of AccountingMax on relays with a monthly traffic cap
by forest 04 Nov '26

04 Nov '26

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. The Tor Project website recommends configuring an accounting period to put relays into hibernation rather than setting a bandwidth limit in the case where a relay has a traffic cap. Wouldn't it be better to adjust MaxAdvertisedBandwidth instead? Setting an accounting period disables DirCache which prevents the relay from being an HSDir or a guard. Unlike RelayBandwidthRate which throttles connections and can adversely impact user experience, MaxAdvertisedBandwidth just tells the dirauths to limit your consensus weight (iirc) so fewer clients choose you. Has anyone experimented with dynamically changing MaxAdvertisedBandwidth based on monthly traffic remaining so that it uses the majority of its monthly traffic limit without going over? Regards, forest -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCauu0VQAKCRAw+TRLM+X4 xqLWAP9BpmWAdp2pT056kFMpg4ecqR6bfXaoJGW6RNiLl0vZRwD/fpR1ef2fjncA bv7YIVXpQGLkWl3vzPGcd7c+Hfyn3w8= =nTfd -----END PGP SIGNATURE-----

1 0

Shutting down my ~40 guards
by forest 03 Nov '26

03 Nov '26

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. Within a matter of minutes, quite a few of my relays have come under attack again. As there has been no progress in mitigating the attacks despite several new releases of Tor coming out and no information from the devs about any in-progress mitigations or even plans to develop a mitigation, I'm no longer able to run relays that are eligible for the HSDir flag. The attacks have been causing financial strain to me and straining my relationship with my hosting providers, many of which I have spent significant effort to convince to allow Tor. If someone knows of a mitigation, can poke the devs to write one, can point me in the right direction for writing my own without getting my relays marked bad for behaving in a non-standard way, or knows of a way to get my relays blacklisted from the HSDir flag besides just setting DirCache 0 (which also prevents being a guard), please tell me. This is a difficult decision, but if there's really no plan or progress in developing a mitigation for these attacks, I'll be shutting down ~40 guards over the next several days. I just don't know what else to do. Regards, forest -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCasyPGgAKCRAw+TRLM+X4 xq01APsF9oxsd74W9sK/cO+xnt4HWZWZ/A7MWc8s2WUHN7telwD/SeoVfuzjaJIM 0NcyOUQVi9jzqkqfr4JEnASneNkh8g0= =dFuQ -----END PGP SIGNATURE-----

20 53

sysctl tweaks for tiny relays
by Toralf Förster 03 Nov '26

03 Nov '26

I made good experiences by tweaking sysctl values at tiny relays (1 GB RAM, 1 vCPU) and do wonder about your opion/experiences: $ ssh i30 cat /etc/sysctl.d/21firewall.conf # maintained by Ansible net.ipv4.tcp_fin_timeout = 10 net.ipv4.tcp_keepalive_time = 120 net.ipv4.tcp_max_syn_backlog = 8192 net.ipv4.tcp_mem = 2000 4000 8000 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_tw_reuse = 1 net.ipv6.ip_nonlocal_bind = 1 net.netfilter.nf_conntrack_tcp_timeout_close_wait = 10 net.netfilter.nf_conntrack_tcp_timeout_established = 600 net.netfilter.nf_conntrack_tcp_timeout_time_wait = 10 net.core.netdev_max_backlog = 131072 net.core.somaxconn = 16384 net.ipv4.tcp_max_syn_backlog = 131072 net.ipv4.tcp_notsent_lowat = 131072 net.netfilter.nf_conntrack_buckets = 131072 net.netfilter.nf_conntrack_max = 131072 -- Toralf

4 6

MyFamily Support Timeline
by ProSecureRelays 03 Nov '26

03 Nov '26

Hi there, a short question regarding the timeline of the MyFamily Support: There was a discussion earlier this year, and from my understanding, it was scheduled EoL somewhere near Q3/Q4 2026 (2026-09-01 is my last information to be precise, with the planned EoL of 0.4.8.x). I was editing the torrc file while upgrading to 4.9.15 to increase the MaxMemInQueues Value and removed the MyFamily line because I thought the time has come. But when bootstrapping, the warning regarding the missing MyFamily showed up again. So, obviously I was wrong, and I will add it back with the next planned restart. Is there a known fixed date where the MyFamily "Option" in the torrc file should be removed? Best regards! Joker

2 1

Outbound circuit has 1500 cells in its queue
by forest 01 Nov '26

01 Nov '26

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. My new relay, 6B24AB532979E56A956A4F5EE23CC0B4AA17FA81, is experiencing somewhat higher inbound traffic than outbound. It doesn't appear to be the attack from what I can tell (there is no BEGIN_DIR flood), but it's causing the log to be spammed with "Outbound circuit has 1500 cells in its queue, maximum allowed is 1500. Closing circuit for safety reasons." every few seconds when ProtocolWarnings is enabled in the torrc. Average inbound traffic is 433 KiB/s but average outbound is 329 KiB/s. It's a new relay so some fluctuation is to be expected, but not this. The relay's network has plenty of spare bandwidth and there's no signs of traffic shaping. What could be causing this? Regards, forest -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCauVD5QAKCRAw+TRLM+X4 xhlEAP48H5bH6RuF7Uwnn7FDZ5uMbqSKwZnDYkC9rPPmtwGSdwD/aMSXfa0NyNea vYQ6v6JSf1RNBNNpoqYaSYjCZeZG8g0= =xCNs -----END PGP SIGNATURE-----

2 2