- tor-relays - lists.torproject.org

Re: [tor-relays] DoS attacks on multiple relays
by Aneesh Dogra 05 Dec '17

05 Dec '17

Interesting to see. I have similar stats. 10 connections from 188.214.30.0/24, second up 8 connections from 178.16.208.0/24. Thanks! On Tue, Dec 5, 2017 at 4:27 PM, x9p <tor(a)x9p.org> wrote: > > first measure on a good day how many connection per /24 your exit/relay > have, excluding these with 1 2 or just 3 connections: > > # netstat -tupan | grep ESTABLISHED | grep /tor | awk '{print $5}' | awk > -F: '{print $1}' | awk -F. '{print $1"."$2"."$3}' | sort | uniq -c | … [View More]

2 2

Re: [tor-relays] DoS attacks on multiple relays
by null 05 Dec '17

05 Dec '17

> connlimit per /24. it does more good than evil. Any guidance on the specifics? Like how many concurrent connections to allow per /24? Not sure what's expected from legitimate user traffic through the relay... don't want to make things worse.

2 2

Save the date! Thursday, Dec 07 - Tor Meetup in NYC
by isabela＠riseup.net 04 Dec '17

04 Dec '17

Hello community! We are sending this 'save the date' note to let you know that on Thursday December 7th on the 20th floor of 150 Broadway in the LMHQ shared meeting space at 6:45 PM. There are a lot of folks from the community in NYC so we thought it would be cool to have some time share skills, learn new things, and be a place for new folks who want to get involve to come and meet folks. For this first one we will be talking about our community of relay operators. You can read more at this … [View More]

3 2

Please disregard 'excessive bounce' notice
by Damian Johnson 01 Dec '17

01 Dec '17

Hi all. Everyone with a gmail account not a notice that their subscription was suspended due to excessive bounces. You can ignore this notice, no action is needed on your part. I'm not entirely sure of the root cause but something similar happened a few years back with another list too. I've disabled automated bounce processing and re-enabled everyone's subscription. Cheers! -Damian

1 0

do the 800+ UbuntuCore relays constitute a Sybil attack?
by starlight.2017q4＠binnacle.cx 01 Dec '17

01 Dec '17

The population of these has been climbing for more than a week and no-one has commented, which seems odd. No contact provided. https://atlas.torproject.org/#search/UbuntuCore

4 4

Tor security releases coming tomorrow
by Nick Mathewson 30 Nov '17

30 Nov '17

I'm sending this message to announce that we will be releasing new stable and versions of Tor tomorrow, to fix 5 security bugs. I apologise for the short notice; we've had to move up our intended release date in order to try to match with release deadlines for downstream projects. We have classified 3 of these bugs as Medium and 2 as High, per draft security process at https://trac.torproject.org/projects/tor/wiki/org/teams/NetworkTeam/Securit… . The most serious bugs are a pair of denial-… [View More]

1 0

Screening DNS
by Dr Gerard Bulger 29 Nov '17

29 Nov '17

The DNS 9.9.9.9 https://www.theregister.co.uk/2017/11/20/quad9_secure_private_dns_resolver/ At least is not blocking my exit node IP, simply because it is TOR! Nice. So far. Gerry

6 7

ymkeo offline
by René Ladan 28 Nov '17

28 Nov '17

Hi, due to hardware problems my node ymkeo 4E8CE6F5651E7342C1E7E5ED031E82078134FB0D will be offline for an undetermined amount of time. René

1 1

Re: [tor-relays] Detecting Network Attack [re: exit synflooded]
by Dhalgren Tor 26 Nov '17

26 Nov '17

>Well, it's still going on, and is pretty much ruining Libero :( . Running CentOS 6, here. > >When it's happening it can look like this: > ># netstat -n | grep -c SYN >17696 I run a fast exit and can offer some advice: 1) mitigate bug #18580 (also #21394); is a DNS denial-of-service and could be the problem. either upgrade to 0.3.2.4+ or edit resolve.conf per https://trac.torproject.org/projects/tor/wiki/doc/DnsResolver#Tuningeventdn… also check out https://… [View More]

4 5

Re: [tor-relays] Pretty sure our exit was being synflooded
by tor＠t-3.net 26 Nov '17

26 Nov '17

I spoke too soon, it seems - the exit is struggling again, with some time spent destroyed today. As I look at what it's doing, it's clear that someone is relaying SYN packets to random ports and also random destination addresses that aren't even alive. The destination hosts and ports continually vary - it never hits multiple destinations on 1 port, and it does not hit multiple ports on 1 host. I presume it is an attack that is intended to degrade this relay's service quality, or … [View More]

2 1