- tor-relays - lists.torproject.org

Re: [tor-relays] BWauth no-consensus state in effect
by starlight.2015q2＠binnacle.cx 30 Jul '15

30 Jul '15

Welcome. This event led to my discovering the Unmeasured=1 flag in the cached-*consensus files (was wondering where it was). That new BWauth is badly needed. See about 460 unmeasured relays and from an unscientific sample it seems like many of them are stuck-at-20 exit nodes--valuable resources that should be utilized. At 15:17 7/30/2015 -0500, you wrote: >On 30 July 2015 at 12:14, Tom Ritter <tom(a)ritter.vg> wrote: >> Thanks for the heads up! >> >> A fifth bwauth is expected to start >> voting "real soon now", and I'm >> not sure why maatuska didn't vote >> on bwauth data last vote, but I've >> pinged some folks so hopefully we >> can get this resolved quickly. > >Aaaand we're back! =) Sorry for the outage. > >Bandwidth scanner status > >maatuska 6890 Measured values in w lines >gabelmoo 6444 Measured values in w lines >moria1 6754 Measured values in w lines > >-tom

1 0

Re: [tor-relays] BWauth no-consensus state in effect
by starlight.2015q2＠binnacle.cx 30 Jul '15

30 Jul '15

Much of Tor traffic is from long-term circuits moving bulk data, so apparently it will take many hours or even days for rebalancing to fully take effect. Is not clear whether it will cause serious trouble or not. My thought is that one BWauth in a consensus is better than self-measure, as BWauths are trusted entities and a single rouge BWauth in some kind of attack taking out the rest would be dealt with via manual intervention or the closing down of Tor. Perhaps the self-measure cap of 10k should be raised as well. Was an anti-gaming mitigation from the pre- BWauth days and may have even preceded the arrival of super-fast relays. At 12:14 7/30/2015 -0500, you wrote: >Thanks for the heads up! > >A fifth bwauth is expected to start voting "real >soon now", and I'm not sure why maatuska didn't >vote on bwauth data last vote, but I've pinged >some folks so hopefully we can get this resolved >quickly. > >-tom > >On 30 July 2015 at 12:04, <starlight.2015q2(a)binnacle.cx> wrote: >> FYI list >> >> https://trac.torproject.org/projects/tor/ticket/16696 >> >> Description >> >> At present both 'longclaw' and 'maatuska' have >> dropped out of the BW consensus ('longclaw' >> is restarting with new version, not sure >> about 'maatuska'). >> >> This has caused the BW consensus logic to revert >> to using relay self-measurement for BW weightings >> due to fewer than three BW authorities participating. >> >> The 10000 cap placed on self-measure values >> is causing super-fast relays serious demotion >> and slower relays corresponding promotion >> in the consensus weighting. >> >> Possibly this may result in network >> unbalance issues. Some adjustment >> of the logic seems in order. >>

1 0

Giving away some "pre-warmed" relay keys for adoption
by Roman Mamedov 29 Jul '15

29 Jul '15

Hello, If anyone is planning to spin up a new VM or dedi to run a Tor relay and want it to be put instantly into good use (without wasting couple of weeks to a month for the whole "unmeasured relay/measured/guard/stable" cycle to complete) or if you are having trouble with your current relay being measured properly, in a few days I'm considering to give away several fingerprints+keys from my relays that I will be shutting down. If you install Tor on a new machine and unpack one of these into your /var/lib/tor, it starts up something like this (see below); i.e. in a couple of hours to a full 100% utilization. eth0 16:59 ^ t | t t rt rt rt rt | rt rt rt rt rt rt rt | rt rt rt rt rt rt rt rt | rt rt rt rt rt rt rt rt rt | rt rt rt rt rt rt rt rt rt | rt rt rt rt rt rt rt rt rt | rt rt rt rt rt rt rt rt rt rt | rt rt rt rt rt rt rt rt rt rt rt | rt rt rt rt rt rt rt rt rt rt rt -+---------------------------------------------------------------------------> | 17 18 19 20 21 22 23 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 16 h rx (KiB) tx (KiB) h rx (KiB) tx (KiB) h rx (KiB) tx (KiB) 17 0 0 01 0 0 09 34135840 34964598 18 0 0 02 0 0 10 37991652 38890814 19 0 0 03 0 0 11 38710878 39749495 20 0 0 04 0 0 12 39168357 40164982 21 0 0 05 50433 1472 13 42351426 43626118 22 0 0 06 10904079 10927593 14 42826283 43928095 23 0 0 07 15691530 15839439 15 41240931 42507372 00 0 0 08 27079433 27403035 16 41941981 43139517 Drop me an E-Mail if you want one of these (probably about 2-3 available for now). -- With respect, Roman

8 14

Re: [tor-relays] pinning relay keys to IPs (or not)
by starlight.2015q2＠binnacle.cx 29 Jul '15

29 Jul '15

>(where a lot of IPs changed their AS from >IANA to Digital Ocean) A couple of minor notes regarding ASNs: 1) many IPs fall under a hierarchy of ASs where a large core-network provider (e.g. Level3) advertises a block and a second client leaf-AS advertises a sub- block. Sometimes the core AS advertises the smaller blocks though that has diminished with the CIDR route consolidation initiative. Also some ASs advertise bocks and sub-blocks. This shows up often with the CYMRU lookup data dig +short D.C.B.A.origin.asn.cymru.com txt and DNS will rotate the multiple advertisements, so one should sort the list by CIDR size and select the smallest block (i.e. largest CIDR "/" value). Possibly MaxMind takes care of all this in their data. 2) one can likely ignore AS changes when the IP has not changed, thus avoiding problems caused by network restructuring 3) perhaps many dynamic allocations where the IP changes to different AS can be detected by examining the AS owner identifiers and looking for a match I agree guards are special and perhaps should not be allowed to change ASs at all without loosing the flag, maybe even should stay glued to one IP to avoid any failed client connections and the negative impact that may have on anonymity. It seems reasonable to allow dynamic-IP middle and exit relays.

2 2

pinning relay keys to IPs (or not)
by nusenu 29 Jul '15

29 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 [split from 'Giving away some "pre-warmed" relay keys for adoption'] > I'm of the opinion that it may be worth adding code to pin relay > identities to IP addresses on the DirAuth side so that consensus > weight and flag assignment gets totally reset if the ORPort IP > changes, but if there's too much churn already it may cause more > trouble than it's worth. I hope such code will not be added, because it renders relays on dynamic IPs basically useless. In the past ~week only there were >1000 fingerprints (<3% cw fraction) using more than one IP address (in that timeframe) > I'm somewhat torn on the whole key pinning thing, because I think > an individual operator moving their relay around is sort of ok > (though in an ideal world the consensus weight should get reset and > rapidly re-measured), but giving away the private component of a > relay's identity key is putting users at risk, and is behavior that > should be discouraged if not outright prohibited if possible (and > key pinning would be a heavy handed way to rule out this sort of > stupidity). -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVtOqsAAoJEFv7XvVCELh0N2oQAJYXVGM0hHJzBl3i7tkfZx8E hEd9PgyX0v+nXnlAU06lsFltK12VaCkXp9Gft8TlmshP6NqsdHk+KPrtumUE7IA4 MmYmmVi5Tb8AyN241nr/RbYOUS+9nz2VvtkhaikkvbFxwzua678I13P1PC/QPki3 S4KwQ0YYYlUrG529GhLaGkm5byX3N+MAdGQn04xzCDzBW/j3GxbZYBj4+tqgHONR 9iAs5/p00MFVGp3Ex8xJKBVRW0NRT//fKRrZtRDBaNxduUg7F0EccO4zlPjTUBAM e+g8tergT4ICixddhRih0iGA3ysw3/mI1KyvOMegZXkUQ0Yo+puR4O7S2w4WoWRh 1tkkbcFWAh4sCKDPLlD/sqWKFDkHLtP3AOG+KGgybkhULNU1GgAftV39QVrsABx/ oP/dhC9d+MablSZg6qS8dxTV3L+E5EdE2RX226+BPjRkUSqphojEYjDpiaR3/COU 2BmACmPIuiS60DfaiqygKQaCwvgDl6q96o5oZEmPHem2SIxh5o3DD1wLJgKKEsiL WgmoRHTLfqc2Uq0442oi7KMhgGcIffS8xKbb1xw/9yIF2WiKrluFFWau5k6cQYA2 0buDAz7WWi7kxUCnn39NcyrtWoOWMziRH+rjv5esoRN7W5k2GNtBcylZ6kyzcudr hy7j6rYMLpUHsVc2NHKd =8W7p -----END PGP SIGNATURE-----

5 9

Very unbalanced in/out connection ratio
by mattia 29 Jul '15

29 Jul '15

Hello, I've been running a middle relay [1] for months and I have always noticed an unbalance between incoming and outgoing connections (monitored through arm). The incoming connections were always in between 0-10% more than the outgoing ones. This morning though the unbalance has reached so far unseen levels: arm reports more than 2500 incoming connections while outgoing are little more than 200. Is this normal and, if so, why? Thank you, Mattia [1] https://globe.torproject.org/#/relay/0D14A4498E7D1854696CC07548653EA4CD3CB2…

2 2

Re: [tor-relays] longclaw BWauth is broken -- no measurements since 7/22
by starlight.2015q2＠binnacle.cx 28 Jul '15

28 Jul '15

Longclaw is broken again. Has not updated 55% of the the relay BS measurments for forty hours. Updated the ticket below with details and raise it to "major" issue. At 16:42 7/25/2015 -0400, you wrote: >Realized not everyone monitors this >list so I opened a Trac ticket: > >https://trac.torproject.org/projects/tor/ticket/16667 > > > >At 11:19 7/25/2015 -0700, you wrote: >>Interesting. Thanks starlight for the head's up! I'm not >>aware of any known issues with longclaw right now >>so looping in its operator. >> >> >>On Sat, Jul 25, 2015 at 10:09 AM, >><starlight.2015q2(a)binnacle.cx> wrote: >>> Subject says it. >>> >>> Thought it was strange that its measurement >>> of my relay has not been moving. Pulled the >>> vote history and grep'ed a dozen relay >>> measurements and none of them have changed. >>>

1 0

pinning relay keys to IPs (or not)
by starlight.2015q2＠binnacle.cx 26 Jul '15

26 Jul '15

Perhaps a way to do it is reset the consensus for a relay if its IP address moves to a different Autonomous System. Is rare that dynamic IP causes relays to hop ASs (e.g. possibly SBC/ATT), and list of exceptions could be created for the few cases where it causes trouble. CYMRU has a dynamic service for looking up AS from IP.

3 2

Re: [tor-relays] longclaw BWauth is broken -- no measurements since 7/22
by starlight.2015q2＠binnacle.cx 25 Jul '15

25 Jul '15

Realized not everyone monitors this list so I opened a Trac ticket: https://trac.torproject.org/projects/tor/ticket/16667 At 11:19 7/25/2015 -0700, you wrote: >Interesting. Thanks starlight for the head's up! I'm not >aware of any known issues with longclaw right now >so looping in its operator. > > >On Sat, Jul 25, 2015 at 10:09 AM, ><starlight.2015q2(a)binnacle.cx> wrote: >> Subject says it. >> >> Thought it was strange that its measurement >> of my relay has not been moving. Pulled the >> vote history and grep'ed a dozen relay >> measurements and none of them have changed. >>

1 0

longclaw BWauth is broken -- no measurements since 7/22
by starlight.2015q2＠binnacle.cx 25 Jul '15

25 Jul '15

Subject says it. Thought it was strange that its measurement of my relay has not been moving. Pulled the vote history and grep'ed a dozen relay measurements and none of them have changed.

2 1

Re: [tor-relays] How to Run High Capacity Tor Relays
by Green Dream 24 Jul '15

24 Jul '15

Pardon the thread necromancy, but I'm wondering if this document ever made its way off this mailing list and onto a blog? Or perhaps there is some other modern doc covering this topic? I've recently setup a relay on a Gb/s fiber connection, and am struggling to understand how to optimize performance. It's not clear 5 years later which if any of the tweaks listed below are still relevant. I'm running a modern debian-based system. Thanks in advance. > After talking to Moritz and Olaf privately and asking them about their > nodes, and after running some experiments with some high capacity > relays, I've begun to realize that running a fast Tor relay is a > pretty black art, with a lot of ad-hoc practice. Only a few people > know how to do it, and if you just use Linux and Tor out of the box, > your relay will likely underperform on 100Mbit links and above. > In the interest of trying to help grow and distribute the network, my > ultimate plan is to try to collect all of this lore, use Science to > divine out what actually matters, and then write a more succinct blog > post about it. > However, that is a lot of work. It's also not totally necessary to do > all this work, when you can get a pretty good setup with a rough > superset of all of the ad-hoc voodoo. This post is thus about that > voodoo. > Hopefully others will spring forth from the darkness to dump their own > voodoo in this thread, as I suspect there is one hell of a lot of it > out there, some (much?) of which I don't yet know. Likewise, if any > blasphemous heretic wishes to apply Science to this voodoo, they > should yell out, "Stand Back, I'm Doing Science!" (at home please, not > on this list) and run some experiments to try to eliminate options > that are useless to Tor performance. Or cite academic research papers. > (But that's not Science, that's computerscience - which is a religion > like voodoo, but with cathedrals). > Anyway, on with the draft: > > == Machine Specs == > First, you want to run your OS in x64 mode because openssl should do > crypto faster in 64bit. > Tor is currently not fully multithreaded, and tends not to benefit > beyond 2 cores per process. Even then, the benefit is still marginal > beyond just 1 core. 64bit Tor nodes require about one 2Ghz Xeon/Core2 > core per 100Mbit of capacity. > Thus, to fill an 800Mbit link, you need at least a dual socket, quad > core cpu config. You may be able to squeeze a full gigabit out of one > of these machines. As far as I know, no one has ever done this with > Tor, on any one machine. > The i7's also just came out in this form factor, and can do > hyperthreading (previous models may list 'ht' in cpuinfo, but actually > don't support it). This should give you a decent bonus if you set > NumCPUs to 2, since ht tends to work better with pure integer math > (like crypto). We have not benchmarked this config yet though, but I > suspect it should fill a gigabit link fairly easily, possibly > approaching 2Gbit. > At full capacity, exit node Tor processes running at this rate consume > about 500M of ram. You want to ensure your ram speed is sufficient, > but most newish hardware is good. Using on this chart: > > https://secure.wikimedia.org/wikipedia/en/wiki/List_of_device_bandwidths#Me… > you can do the math and see that with a dozen memcpys in each > direction, you come out needing DDR2 to be able to push 1Gbit full > duplex. > As far as ethernet cards, the Intel e1000e *should* be theoretically > good, but they seem to fail at properly irq balancing across multiple > CPUs on recent kernels, which can cause you to bottleneck at 100% CPU > on one core. At least that has been Moritz's experience. In our > experiments, the RTL-8169 works fine (once tweaked, see below). > > == System Tweakscript Wibbles and Config Splatters == > First, you want to ensure that you run no more than 2 Tor instances > per IP. Any more than this and clients will ignore them. > Next, paste the following smattering into the shell (or just read it > and make your own script): > # Set the hard limit of open file descriptors really high. > # Tor will also potentially run out of ports. > ulimit -SHn 65000 > # Set the txqueuelen high, to prevent premature drops > ifconfig eth0 txqueuelen 20000 > # Tell our ethernet card (interrupt found from /proc/interrupts) > # to balance its IRQs across one whole CPU socket (4 cpus, mask 0f). > # You only want one socket for optimal ISR and buffer caching. > # > # Note that e1000e does NOT seem to obey this, but RTL-8169 will. > echo 0f > /proc/irq/17/smp_affinity > # Make sure you have auxiliary nameservers. I've seen many ISP > # nameservers fall over under load from fast tor nodes, both on our > # nodes and from scans. Or run caching named and closely monitor it. > echo "nameserver 8.8.8.8" >> /etc/resolv.conf > echo "nameserver 4.2.2.2" >> /etc/resolv.conf > # Load an amalgam of gigabit-tuning sysctls from: > # http://datatag.web.cern.ch/datatag/howto/tcp.html > # http://fasterdata.es.net/TCP-tuning/linux.html > # http://www.acc.umu.se/~maswan/linux-netperf.txt > # http://www.psc.edu/networking/projects/tcptune/#Linux > # and elsewhere... > # We have no idea which of these are needed yet for our actual use > # case, but they do help (especially the nf-contrack ones): > sysctl -p << EOF > net.ipv4.tcp_rmem = 4096 87380 16777216 > net.ipv4.tcp_wmem = 4096 65536 16777216 > net.core.netdev_max_backlog = 2500 > net.ipv4.tcp_no_metrics_save = 1 > net.ipv4.tcp_moderate_rcvbuf = 1 > net.core.rmem_max = 1048575 > net.core.wmem_max = 1048575 > net.ipv4.ip_local_port_range = 1025 61000 > net.ipv4.tcp_synack_retries = 3 > net.ipv4.tcp_tw_recycle = 1 > net.ipv4.tcp_max_syn_backlog = 10240 > net.ipv4.tcp_fin_timeout = 30 > net.ipv4.tcp_keepalive_time = 1200 > net.netfilter.nf_conntrack_tcp_timeout_established=7200 > net.netfilter.nf_conntrack_checksum=0 > net.netfilter.nf_conntrack_max=131072 > net.netfilter.nf_conntrack_tcp_timeout_syn_sent=15 > net.ipv4.tcp_keepalive_time=60 > net.ipv4.tcp_keepalive_time = 60 > net.ipv4.tcp_keepalive_intvl = 10 > net.ipv4.tcp_keepalive_probes = 3 > net.ipv4.ip_local_port_range = 1025 65530 > net.core.netdev_max_backlog=300000 > net.core.somaxconn=20480 > net.ipv4.tcp_max_tw_buckets=2000000 > net.ipv4.tcp_timestamps=0 > vm.min_free_kbytes = 65536 > net.ipv4.ip_forward=1 > net.ipv4.tcp_syncookies = 1 > net.ipv4.tcp_synack_retries = 2 > net.ipv4.conf.default.forwarding=1 > net.ipv4.conf.default.proxy_arp = 1 > net.ipv4.conf.all.rp_filter = 1 > net.ipv4.conf.default.send_redirects = 1 > net.ipv4.conf.all.send_redirects = 0 > EOF > # XXX: ethtool wibbles > # You may also have to tweak some parameters with ethtool, possibly > # also enabling some checksum offloading or irq coalescing options to > # spare CPU, but for us this hasn't been needed yet. > > == Setting up the Torrc == > Basically you can just read through the stock example torrc, but there > are some as-yet undocumented magic options, and options that need new > defaults. > # NumCPUs doesn't provide any benefit beyond 2, and setting it higher > # may cause cache misses. > NumCPUs 2 > # These options have archaic maximums of 2-5Mbyte > BandwidthRate 100 MB > BandwidthBurst 200 MB > > == Waiting for the Bootstrap and Measurement Process == > Perhaps the most frustrating part of this setup is how long it takes > for you to acquire traffic. If you are starting new at an ISP, I would > consider only 200-400Mbit for your first month. Hitting that by the > end of the month may be a challenge, mostly because their may be dips > and total setbacks along the way. > The slow rampup is primarily due to limitations in Tor's ability to > rapidly publish descriptor updates, and to measure relays. > It ends up taking about 2-3 days to hit an observed bandwidth of > 2Mbyte/sec per relay, but it can take well over a week or more (Moritz, do > you have a better number?) to reach 8-9Mbyte/relay. This is for an > Exit node. A middle node will likely gather traffic slower. Also once > you crash, you lose it. This bug is about that issue: > https://trac.torproject.org/projects/tor/ticket/1863 > There is also a potential dip when you get the Guard flag, as our load > balancing formulas try to avoid you, but no clients have chosen you > yet. Changes to the authority voting on Guards in Tor 0.2.2.15 should > make this less drastic. It is also possible that your observed > bandwidth will be greater than without it. However, it will still take > up to 2 months for clients to choose you as their new Guard. > > == Running temporary auxiliary nodes == > One way to shortcut this process and avoid paying for bandwidth you > don't use is to spin up a bunch of temporary nodes to utilize the CPU > and quickly gather that easy first 2MB/sec of observed bandwidth. > But you need the spare IPs to do this. > > == Monitoring == > Personally, I prefer console-based options like nload, top, and > Damian's arm (http://www.atagar.com/arm/) because I don't like the > idea of running extra services to publish my monitoring data to the > world. > Other people have web-based monitoring using things like munin and > mrtg. It would be nice to get a script/howto for that too. > > == Current 1-Box Capacity Record == > Our setup has topped at 450Mbit, but averages between 300-400Mbit. We > are currently having uptime issues due to heat (melting, poorly > ventilated harddrives). It is likely that once we resolve this, we > will continually increase to our CPU ceiling. > I believe Moritz and Olaf also push this much capacity, possibly a bit > more, but with less nodes (4 as opposed to our 8). I hear Jake is also > ramping up some Guard nodes (or maybe I didn't? Did I just betray you > again Jake?) > > == Did I leave anything out? == > Well, did I? > > -- > Mike Perry > Mad Computer Scientist > fscked.org evil labs

8 11

Running a relay in the Netherlands
by TorOps 24 Jul '15

24 Jul '15

Hello, I am about to move to the Netherlands and will, as part of the move, decommission the server my relay is currently running on. I'd like to be able to continue to help, though, so I wonder how the legal climate is for Tor relays and/or exit nodes in the Netherlands? On a related topic, how smart/efficient/possible is it to run a relay/exit on a Raspberry Pi? Thanks for any info. -- Regards, StairNetTor Operator

6 7

The ultimate DMCA culprit
by I 24 Jul '15

24 Jul '15

2 1

[warn] Content-Length is less than zero; it looks like someone is trying to crash us
by Toralf Förster 23 Jul '15

23 Jul '15

4 6

Fwd: Tor family graphs
by Virgil Griffith 23 Jul '15

23 Jul '15

Hello tor-relays@ We are still working on your nice relay incentive as and part of that we've been looking at how to partition relays into different families with it's not 100% obvious what that groupings should be. For those that are interested in the family connections, I have some pretty PDFs for you. I present three graphs of all Tor relays (nodes) with at least one family connection (edge). (1) only symmetric edges shown (black) -- http://dl.dropbox.com/u/3308162/sym.pdf (2) only asymmetric edges shown (red) -- http://dl.dropbox.com/u/3308162/asym.pdf (3) both symmetric (black) and asymmetric (red) shown -- http://dl.dropbox.com/u/3308162/both.pdf Notes: * A node is colored red if and only if it is the origin of an asymmetric connection. Ergo, every red node has at least one red edge, and vice-versa. * Blue edges are self-connections. I presume the Tor directory authorities should be excluding should these edges from the consensus---unless you all like being cute? Unfortunately you cannot click to see where you are in the graph. Hopefully in a future version you'll be able to click-around using D3.js or some such. -V

4 8

OpenBSD: tor rc script: don't kill unrelated tor instances (patch)
by nusenu 22 Jul '15

22 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Pascal, what do you think of changing OpenBSD's tor rc script to require perfect process matches when sending signals to them instead of the current "kill everything that starts with..." approach? I've put tor-relays on CC so people can speak up if this change is not desired or breaks anyone's environment - I believe it fixes them. Problem: /etc/rc.d/tor stop might kill all (including unrelated) tor instances instead of the intended daemon only. /etc/rc.d/tor start might never start the intended daemon if another tor instance is already running (rc_check believes tor is already running). /etc/rc.d/tor restart might kill all tor instances and starts only one. references: http://article.gmane.org/gmane.os.openbsd.misc/222896 One line "patch" for /etc/rc.d/tor to address this issue: (tested with and without custom daemon_flags) 8a9,10 > pexp="${daemon}${daemon_flags:+ ${daemon_flags}}$" > (this line is a complete copy from rc.subr with the addition of one char: $ ) thanks, nusenu https://github.com/nusenu/ansible-relayor/issues/40 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJViSx3AAoJEFv7XvVCELh0y8UQAJgb6JVbKde/xf79YJJr8LW1 t+Rji8A5zZ9VsjcW4Pguf/OZsQEN3MEIkjzTM3kw0q9S8CPnDbF3IYOaZj4ewYkX 8OoNmHfFbcQCC0YCJBlbUJMBtNJqi8pg7qRY4o+qY9KKa9ekUhPer7kzUt4N1A+T an4z44lh3ytAcehyFxo6hpDGZHHGGsACEIql9Rav6v+DPCBSJnCZsmlT0OeTeV5k 5WEy9nTVzdkX4mKs1xXv8YJFggCrb1uur3q91/5ZGhpKADfRj6T+1i/9622Bcki9 17ADc4ZI73dP3ZelKvpZ+FXhaiZLn6tugdj2dcqnXU8Zras6jKToupFi2nB8xfTV f70qSdkMP6WOJReCP+KTAGHiCkapyoc9V+8569iZIjUXuD7GbbSpP6I1rOoqSLYH rao6WpqHVfSMQ5jCaECHBbZY62qBhHH83B/um3nG+WXvvWDPpzjkbEx56RxH3UUo yZ4naGenbxQzCXsGXhEOAmUkJjSmW+Hw75EyObBLAp00+Q8zAXkHnFOqRGbRuxdl IKqAYsfGNLr7kPBvz9pxfnOJMfyIBDQ2P2WNyKXvYLME3wKbYMazVxd7cXzmAV5g QthMuFJ/JhWYI9Lb1U+IQq7LOX+pEWU6u/L2xqjTDj7VMn4UF1WZ6UHhnaLMAotZ lfiTKPnopA62t+X05ztR =ysgm -----END PGP SIGNATURE-----

3 5

Re: [tor-relays] Running a relay in the Netherlands
by Jan Hendrik den Besten 22 Jul '15

22 Jul '15

> Date: Tue, 21 Jul 2015 00:13:19 +0200 > From: t0reo(a)t0reo.eu > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Running a relay in the Netherlands > > Hello All ! > > About running a relay in the NL, what host company would you guys > recommend ? > > I also have that idea of running first a relay then an exit node, and > would like some basic information or recommendation about host > providers, like price /month, bandwidth included, satisfaction or > quality, level of tor friendliness, whatever... > > Thx for any help you can provide, > tOreo I have my node running here in The Netherlands at UPC, now merged with Ziggo. I contacted them once: back then they did not have a problem running even an exit node. BR, JH

4 3

[Relay] Hibernation Reset
by Tor Operator 22 Jul '15

22 Jul '15

Hi gents, I rencetly had one of my relay fall into hibernation. It seems that simply restarting the service doesn't change the hibernation status since Tor is still thinking that the BW limits have been overrun. Is the proper method to reset the status of the node is simply to delete the "state" file in "/var/lib/tor/". For now, I just set back to 0 the "AccountingBytesReadInInterval" and "AccountingBytesWrittenInInterval" counters and the node was able to wake up but that doesn't seem like a very elegant way to do it. Thanks,

2 3

BWauth's / TorFlow seem better
by starlight.2015q2＠binnacle.cx 22 Jul '15

22 Jul '15

Over the last week it seems to me that some improvement has gone into TorFlow and the BWauths are performing better. In particular the weightings calculated by each BWauth have stabilized and become less erratic. Several relays in the same region of a large network as my relay are now showing a roughly matching pattern of ascending measures, from smallest to largest: longclaw, gabelmoo, maatuska, moria1. One would expect this but it was not true in the past. One fast relay I watch, 'pixelminer' had a tendency to be yanked from one extreme to another (e.g. 10k to 120k and back) and now has a placid consensus running in the middle of the range (still apparent in the {presumably stabilized} component values).

1 1

Boosting throughput with own DNS resolvers
by Tim Semeijn 21 Jul '15

21 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Recently I noticed my Tor Exit nodes were showing nameserver errors in the tor log and I decided to set up two private DNS resolvers (pdns-recursor). Since I use those I have seen an increase of traffic throughput on my Exit nodes to approx. 150%. I feel I am finally utilizing the resources available. All bigger Tor relay operators will probably already do it this way, but as I myself have long been using Google DNS or other privacy-aware DNS resolvers on my nodes I just wanted to throw this out in the open. How many of you are already using private DNS resolvers for your nodes? Any feedback/ideas about this? - -- Tim Semeijn Babylon Network pgp 0x5B8A4DDF -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.19 (Darwin) Comment: GPGTools - http://gpgtools.org iQIcBAEBCgAGBQJVrAzLAAoJEIZioqpbik3fmkcP/R5DXaKoVHUY6SjiSJi0n8ug 6NMF2KTXNP3f7vFbuzjWdqdo4Hfj2Zj6SyKc+i99/pJFiISQiGsMfeWjwdGGqaxR hlCNxYAsnV2kFd8UK435kOv2LclPFDMPjFk9OLr+DDQ8ZFmkpF80+95fqwzKaPr0 XtltMNBDxO8uCC4zsNYpT2BlO4EwhMTB5/79lNJ44MlWaSaPd6BAqoDfExyBjZfV v7bvQxqSNxF5jZvoNBRw1/t1jc8AXZF7UxkkR62ff7cBiQsDo16QK4sRcDTNRziM y5fm8Tt9W+19gsf0CNPo7lj7j/T7yHj3gClBi7TmhSxsIO7ylpeuX6L9hsAkzOJm o9TMgkO11T6h0e5EiCJh6P0ov21pqUJ61ScN/D0qiHVJC42UM/diGqVFgev3AT3u NImaA7IPUXvDC+Z+EQulnBP4XdIuukozU/4DJFF4x5tDhyTTXhCInrVsaMB4rOIU lLfQLZiCCC39uxIBs+xvS+rN1+wAVq4VH4Wbd5w4tH7e2Ic0BLBaI71z00RoTiF/ i8TK5IDP+gfykBemXtAcZeyyTkuzf6fFZg3NKfCPGbOqvpLEGEk26Mp8ANv+csTb HQXbmFtPX/SUhxm2zdMzA2uq8gzHOllxmEKriYyon499ZfCImbmBU+1kTKo+v2p7 lOMSGXcjkCVgAwtnZNKw =YekJ -----END PGP SIGNATURE-----

5 6

Re: [tor-relays] Simplifying ExoneraTor
by Joshua Lee Tucker 20 Jul '15

20 Jul '15

Hi guys, I've made some simple (improvements?) changes to the ExoneraTor page - I've basically made the "about" section a sticky footer (no JS) and spaced the content a little better. I've tested it across Firefox/Chrome/Safari/iOS and it looks good on all of them. Maybe we could also add some information about the expected IP and date formats in the whitespace, too. The updated version can be found at: http://tucker.wales/tor/exonerator/ Please let me know what you think. Kind Regards, Joshua Lee Tucker @tuckerwales

2 9

Simplifying ExoneraTor
by Karsten Loesing 20 Jul '15

20 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello relay operators, Julius and I have been working on a design mockup for the ExoneraTor service for the past few months and would want to hear what you think about this: https://people.torproject.org/~karsten/volatile/exonerator-mockup/ The main idea behind this redesign was to simplify the existing ExoneraTor service by omitting technical details (e.g., Tor descriptor contents) and removing mostly unused features (e.g., parsing detailed exit policies). Please take a look at the design mockup, maybe compare it to the existing ExoneraTor service, and let us know your thoughts. Thanks! All the best, Karsten -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQEcBAEBAgAGBQJVlOrvAAoJEJD5dJfVqbCr3LoH/RbAW7FdSG53/rAm/FSE1AI+ mJP/c+Uost5iaymfg1n5nAYVMYSNgg3BanItVbRHBd4rdtdcTz0ZhmUDvol5+jHA eUbWwL5M1SmOZdpNGDxx5fGkm7DEcnSFnVMPqN9gFKtm+zSBtNeJ9bcNiktwL7WW VrpElBu3P9N+YLBemN5W9/TYEjEx6q1Mx4t22qij7xBdRfVJKS1XqwwntRSapbLo Y2TCt/rVG2fD7rMIO3vNidCg8eaA4ax7qXJcABAx1+lsPFHoKwCG0nmNZ6FP+Ips XSbk+FHApAK+txzS16NVwdtOpm/YyCQIVaIQ8EjIyKBSlSJDGWRXwgHOBhglliE= =4/zE -----END PGP SIGNATURE-----

11 48

Exit Policy Information != ExitPolicy reject
by fatal 19 Jul '15

19 Jul '15

Hello, I got an abuse report from Webiron requesting me to block a /24 subnet. Accordingly I added "ExitPolicy reject xxx.xxx.xxx.0/24:*" to my torrc file. Looking at the Exit Policy Information at atlas and torstatus xxx.xxx.xxx.0/24 doesn't get listed. This worries me a bit. Am I missing something? Thanks!

3 4

Catch 22 pay, set-up and be banned
by I 19 Jul '15

19 Jul '15

3 2

Naive question about consensus weight
by Jonathan Baker-Bates 17 Jul '15

17 Jul '15

I've been running an exit node for a number of years without incident, so I tend not to look at its state very much. I'm also not very technically knowledgeable about Tor. However, I notice from Atlas that from January 1st, the exit probability of my server dropped dramatically and has stayed that way together with the observed bandwidth being always a small fraction of the speed I advertise: https://atlas.torproject.org/#details/3612C429C29F698DEAB5072C75E2D700893D0… So I'm curious as to whether there's anything I can do to bring my consensus weight up, apart from just ensuring continuous uptime. That's not often under my control though, since reboots for kernel updates etc. come quite regularly. Apologies if this a common question, but some initial searches on the subject turned up rather too much information for me to understand! Jonathan

4 4