- tor-relays - lists.torproject.org

0.2.6.10 cell fullness
by Austin Holiday 15 Jul '15

15 Jul '15

Hi, has anyone experience any performance differences between 0.2.6.10 vs 0.2.6.9? The logs are different so perhaps it is hard to compare. It seems my connection is not very active. Does the lack of cell fullness suggest an issue?. Log from 0.2.6.10: Jul 14 23:40:33.000 [notice] Heartbeat: Tor's uptime is 17:59 hours, with 0 circuits open. I've sent 277 kB and received 6.27 MB. Jul 14 23:40:33.000 [notice] Average packaged cell fullness: 40.544%. TLS write overhead: 9% Log from 0.2.6.9: Jul 13 19:19:39.000 [notice] Since startup, we have initiated 0 v1 connections, 0 v2 connections, 1 v3 connections, and 16483 v4 connections; and received 83 v1 connections, 1576 v2 connections, 2 v3 connections, and 34108 v4 connections. Jul 14 01:19:39.000 [notice] Heartbeat: Tor's uptime is 14 days 17:59 hours, with 1 circuits open. I've sent 2.07 GB and received 2.19 GB. Jul 14 01:19:39.000 [notice] Circuit handshake stats since last time: 2/2 TAP, 0/0 NTor. Thanks. --Austin

1 0

relay bangs into rock; falls off cliff; recovers
by starlight.2015q2＠binnacle.cx 15 Jul '15

15 Jul '15

I've seen this about three times, maybe four. Anyone have any idea what's going on? Version 0.2.6.10 on Linux. Showed up in 0.2.5.x and 0.2.4.x earlier. 1) seems to happen only one time per relay start after a few hours up to a couple of days; weeks or months between occurrences 2) might be happening after dynamic config change but not certain (did this time, one hour later) 3) might related to / triggered by client activity--was simply browsing regular Internet at the time 4) main thread appears to bog-down, but some traffic continues 5) log messages tied to event :20:26 : Failed to find node for hop 0 of our path. Discarding this circuit. :20:26 : Tried for 120 seconds to get a connection to [scrubbed]:443. Giving up. :20:29 : Failed to find node for hop 0 of our path. Discarding this circuit. :20:32 : Failed to find node for hop 0 of our path. Discarding this circuit. :20:32 : Tried for 122 seconds to get a connection to [scrubbed]:443. Giving up. (waiting for circuit) :20:34 : Failed to find node for hop 0 of our path. Discarding this circuit. :21:06 : last message repeated 14 times :21:45 : last message repeated 23 times 6) for several minutes, all outbound client connection attempts show <fail> in Vidalia; NEWNYM has no effect 7) (5) and (6) imply a rate-limit by the guard but AFIK there was no burst of circuit request that would trigger this 8) client functionality recovers in something like five minutes (awhile after relay forwarding traffic knotch ends) 9) no increase in memory consumption, so apparently no buffering backlog 10) WAN clean, no glitches I suppose I should submit a bug report, but I just finished with a bug-from-hell and am in no mood to work another one, especially since the problem is rare and not fatal.

1 2

nf_conntrack: falling back to vmalloc.
by Toralf Förster 14 Jul '15

14 Jul '15

Starting with 12th ojf June I do get at my tor relay a lot of sslog entries like : Jul 14 14:35:49 tor-relay kernel: [68591.883586] nf_conntrack: falling back to vmalloc. Jul 14 14:35:49 tor-relay kernel: [68591.884749] nf_conntrack: falling back to vmalloc. Jul 14 14:41:11 tor-relay kernel: [68913.618544] nf_conntrack: falling back to vmalloc. Now I'm wondering if this is by any chance related to Tor ? -- Toralf, pgp key: 872AE508 0076E94E

1 0

Re: [tor-relays] relay bangs into rock; falls off cliff; recovers
by starlight.2015q2＠binnacle.cx 14 Jul '15

14 Jul '15

Circuit count seems to have mostly reverted to normal: Tor's uptime is 4 days 18:00 hours, with 6691 circuits open. . . on 3990 channels found an object overview: http://www.kmcg3413.net/aman/index.py?page=tor_internals.txt [connection] [channel] [circuit] [stream]

1 0

relay bangs into rock; falls off cliff; recovers
by starlight.2015q2＠binnacle.cx 13 Jul '15

13 Jul '15

I've seen this about three times, maybe four. Anyone have any idea what's going on? Version 0.2.6.10 on Linux. Showed up in 0.2.5.x and 0.2.4.x earlier. 1) seems to happen only one time per relay start after a few hours up to a couple of days; weeks or months between occurrences 2) might be happening after dynamic config change but not certain (did this time, one hour later) 3) might related to / triggered by client activity--was simply browsing regular Internet at the time 4) main thread appears to bog-down, but some traffic continues 5) log messages tied to event :20:26 : Failed to find node for hop 0 of our path. Discarding this circuit. :20:26 : Tried for 120 seconds to get a connection to [scrubbed]:443. Giving up. :20:29 : Failed to find node for hop 0 of our path. Discarding this circuit. :20:32 : Failed to find node for hop 0 of our path. Discarding this circuit. :20:32 : Tried for 122 seconds to get a connection to [scrubbed]:443. Giving up. (waiting for circuit) :20:34 : Failed to find node for hop 0 of our path. Discarding this circuit. :21:06 : last message repeated 14 times :21:45 : last message repeated 23 times 6) for several minutes, all outbound client connection attempts show <fail> in Vidalia; NEWNYM has no effect 7) (5) and (6) imply a rate-limit by the guard but AFIK there was no burst of circuit request that would trigger this 8) client functionality recovers in something like five minutes (awhile after relay forwarding traffic knotch ends) 9) no increase in memory consumption, so apparently no buffering backlog 10) WAN clean, no glitches I suppose I should submit a bug report, but I just finished with a bug-from-hell and am in no mood to work another one, especially since the problem is rare and not fatal.

1 0

OVH: the biggest and fastest growing autonomous system
by nusenu 13 Jul '15

13 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, OVH is by far the biggest AS on the tor network, in terms of consensus weight (>12%), guard probability (>15%), middle propability (>14%) and in the top 3 by exit probability(>7%). Here are some AS stats for June 2015, that show which ASes added most bandwidth/CW to the tor network. This shows that OVH is not only the biggest AS but also the fasted growing AS: +-------------------------------------+---------+-------------------+ | as_name | new_FPs | added_CW_fraction | +-------------------------------------+---------+-------------------+ | OVH SAS | 98 | 2.129 | | Digital Ocean, Inc. | 44 | 0.936 | | Internet Assigned Numbers Authority | 23 | 0.911 | | ONLINE S.A.S. | 23 | 0.594 | | SOFTplus Entwicklungen GmbH | 4 | 0.512 | | STRATO AG | 8 | 0.274 | | Contabo GmbH | 9 | 0.200 | | LDeX Connect LTD | 5 | 0.200 | | myLoc managed IT AG | 7 | 0.178 | | Core-Backbone GmbH | 2 | 0.160 | | PlusServer AG | 9 | 0.141 | | PCextreme B.V. | 1 | 0.119 | | Hetzner Online AG | 30 | 0.113 | | ISPpro Internet KG | 3 | 0.113 | | United Gameserver GmbH | 4 | 0.107 | | BlazingFast LLC | 12 | 0.101 | | WorldStream | 19 | 0.092 | +-------------------------------------+---------+-------------------+ new_FPs: number of relays (identified by fingerprint) that were first seen in June 2015 and were still running at some point during the last 7 days added_CW_fraction aggregated CW fraction of relays identified in the new_FPs column If you want to help stop this trend, and make the tor network more diverse, choose non-top 10 ASes when adding relays (10 is an arbitrary number). You can use compass 'group by AS' feature to find out about the top X ASes: https://compass.torproject.org/ or if that is unavailable/not working, Thomas White's compass instance: https://compass.thecthulhu.com If you know in advance that you are running guards/exits only you can sort the table by guard or exit probability by clicking on the column name to find out about crowded guard/exit ASes. thanks for running relays, nusenu -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVmFbuAAoJEFv7XvVCELh02FIP/i4ncGP/MDvAehhq+VZraZ/N b7u3L6ZM43zhgLjL4SJQc2mAEfAE9Nf/OCfjAIAdnwr1z+dt0nJZU6ei2RfS045I AwwLsjMZ3hO2l4LLifZcbAGSD0ROd5Il2+Nj90lrBBOmSddjsR/aw5BucDTQqDs2 FTWeezoJEXQcWRnwPPkGwT0bS0vrU4WnXG26lJu3SmUdJyXHEfPHFHiVNKHn04up 0L2fMH7XcFbLkeLyZ2tlhJn+L0asFBch6J5XJMWAyGy1B3uwJDPGpbo4k8eCsRS+ VguyJoEZ1GnVlofx08oX2HbUUhenP9YHtGwRk1joIO8KLR5d5CKNEK3CCkMrqH87 B1uxV/apZV6Bse1H/bMOFxGmCgOgheyRrHPTibDlp5cDyYPysF3piC4jAVs7CSSY 42UD1R53XcLSToVKfCAcH1zCbxa4DpX5Lx+/X0Wb+037Azect6nlUw9lh7edM6Ih jCl8ZVKek2kFg5EHgTVvKCtn9kyW7jXNlbVZ/HP8tO7OlpRIxgZJ46yuwX8nNDzh P9VZ2J33AiPu/G4mcM/MwbhysDBIOsieYP4547gSXSLLnWuQhOteV4y1H5edDneW nbl3WrYA2qDlBfwgJFjvu+jkG3Xbws25RLyesHUvT60i/gXG+sunv1J7JrX6JgW6 D+3xHeWye6kGkEfZgIzr =eeGk -----END PGP SIGNATURE-----

1 1

the effect of bw auth location on relay selection
by nusenu 09 Jul '15

09 Jul '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 (split from 'Qualities of a good relay' thread) > I run a relay in Japan on a gigabit connection, but nobody cares > too much, since (I assume) bwauths aren't anywhere near Japan and > do not get good speeds to it, they give it a low weight, and as a > result it doesn't see a lot of use. Lets say the BW auth is located on your LAN and gives you "1GBit/s" measurements, that would increase the likelihood that clients choose you but if your 1GBit/s uplink is limited to your city/country and the international uplink is eg. 100MBit/s than the measurement value alone wouldn't help much for non-JP partners, no? At least clients in JP would have an measurement value that matches reality better. Actually it would indeed be fancy to have location-aware measurement clients. Clients in Asia would consider asian* bw auth measurements to be more important than measurements from non-asian bw auths, but this presumably performance improvement would likely reduce anonymity properties as clients in JP would more likely choose guards in JP. Attackers targeting JP clients would than be in a better position because they could start guards in JP only and have a higher likelihood of being chosen as guards by a JP client (their targets). performance vs. privacy trade-off as usual. ..and the bw auth system is currently (hopefully) undergoing other changes to prevent recent problems from happening again. I just saw that JP has a guard probability of 0%. (at the same time JP is in the top 10 countries of directly connecting tor users.) Out of 132 relays in JP, there are only 3 guard relays and these 3 are exits as well so they are used as exits only. Your relatively fresh jp relay had the guard flag once for a short period of time, but lost it again - probably due to the last restart. So maybe its usage will rise once it is done with the bootstrapping phase and had the guard flag over a few months. btw: Thanks for running the biggest declared family (by consensus weight) on the tor network! *) there is no bw auth in Asia in reality, current locations: +----------+-----------+---------------+---------+ | nickname | city_name | region_name | country | +----------+-----------+---------------+---------+ | moria1 | Cambridge | Massachusetts | us | | gabelmoo | Erlangen | Bavaria | de | | longclaw | NULL | NULL | us | | maatuska | NULL | NULL | se | +----------+-----------+---------------+---------+ -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVi948AAoJEFv7XvVCELh09EcP/jAL0Gnh9yFpo444pGIipCej TH+hGT+4bNp0irXFVlWk88kBrJ90LR/by7fSwJizEoKaqD9KV5bXuOtl9BdRN+7J nQIcR7rZ6tkMXa71VZX9fG3dvg+GjqbcciMA4tutc3fnXhPScmfLnd1lAZSKoG+M Mt7HzEluW+FZO30ixmPDojVEt2xHC87ntOlYA6rbVBarsXGC2GGP6FDhETOrTftN 0nodbUjIom0W0OyYKPhq/cnS3rckdZDctAKmJDSr7uvmWNWQRiF1eLxUoB96DopQ YthkoErJcv5cuPlwuu1iWvK0fxYen7XNF+hl1bezaRW8aRDBL6dVJDX0JhwAhSzS oKkfkOeuiFiihXbM7dRXwTN9z+wZSIuk3fuJfom+ALrS7Dbu0CER6t5Ynxdbcu8h f7qoroSIK9X0aQhc2RQBXlabkNywLKnsMV+DMJOa5NEHCt5WU9JOwFZax0mGumpj WEzoWEoGR95Z4uFQ5fx9TBmronAlKAHU9C+q0sO0FQSUyHL8WKkBBuWjr3wMSMU7 73+z+LIydb80DpXJ4EurxsF/23MsOiuUk6tUl5NnGMQ8DcQeUDPAtOrIPds6/JZm T6mgBWvB1VQugkoM5pNM24ybEEgp85PtnXpRY/Su4FhpTHMB/2RarGp3GTZw954a /KRXEZb3p9ntEnDnXXoc =S/g8 -----END PGP SIGNATURE-----

2 2

Re: [tor-relays] More consensus weight problems
by Speak Freely 08 Jul '15

08 Jul '15

Rah rah rah... Emailed Aaron directly by accident. Here's the email: Hello, First of all, I love Tor. I love Tor Browser, and I love running relays. When the problems are solved, I will most likely spin up more relays. I'm leaving my fastest relay running, as a method of checking the status for myself. The rest have already started to expire, and within the next week or so most of the other ones will have expired as well. I'm going to try tor-dev-alpha 2.7.1 and change fingerprints, as per a suggestion from s7r, seeing as how I have nothing to lose. I just wish the bwauths could scan relays based off previous relative consensus weights... If this particular relay was at 27000, it should be higher on the list to check compared to another one I have that is at 487. My one relay was blazing fast with thousands of connections, my other is painfully useless with dozens, but my fastest one lost its consensus while the slowest one kept it's consensus. It just seems silly. That being said, I don't know how/if the bwauths scan in any order or just willy-nilly, (that's not entirely true, I know it's segmented to some degree as I recall reading a blog post about how it's chopped up) but... I'd be much less upset if my best relays worked and my worst relays didn't. More complaining... bleh. One thing I would like to point out though... it appears... These problems have at least a casual relationship with MyFamily. One group of MyFamily is completely done - all of them stuck at 20. Another group of MyFamily is working happily. I've been doing some tests over the past few months trying to understand why I keep having problems, and one thing has consistently popped up... MyFamily. As one of MyFamily lost consensus, another family gained consensus back on or around the same time. Yes, especially nusenu, I know I'm supposed to have it all configured to be under 1 MyFamily... But in a way I'm glad I didn't, as the casual relationship I see really could only be seen having done what I did. I say casual because I have no proof of causation. But... it is interesting. If no one else has experienced similar problems, then I'd chock it up to a completely unexpected unrelated set of mysterious circumstances that should not have happened for which there is no explanation. Aaron, if there is anything I can do to help you please let me know. So in conclusion, I'm not done, I'm just not happy. This was supposed to be a short email, oops. Matt Speak Freely

5 7

Faravahar authority key expired
by starlight.2015q2＠binnacle.cx 08 Jul '15

08 Jul '15

The authority node Faravahar's key expired and it dropped off the consensus. Looks purposeful. Does anyone know why? Are authority public keys embedded in the relay code or learned? New release required for new key? Is this usual? Just curious.

2 2

Question about responding to abuse request
by Patrick ZAJDA 05 Jul '15

05 Jul '15

Hi all, I run a Tor exit node, and I received an abuse complain from Webiron. In this mail, I can read the following: "If you run a VPN, anonymizer service (like a TOR exit or proxy node), or business intelligence not contracted with the site owner, then we request that the targeted range be blocked from your service. If it is being blocked, then it's at the right and choice of our clients to refuse access." So if I understand correctly, they ask me to block the targeted range they give me in this report. I know I can block this IP range by adding it to my exit policy, but I would like to know how others exit node operators manage these type of requests, because I ask myself if it is not against tor philosophy to block access to a specific network to Tor users. Thanks all in advance for your answers. Best regards, -- Patrick ZAJDA

5 4

Running a Relay behind a NAT (was Re: unflagged BAD EXIT nodes)
by teor 05 Jul '15

05 Jul '15

> Date: Sat, 4 Jul 2015 19:34:45 -0400 > From: Ben Serebin <ben(a)reefsolutions.com> > Subject: Re: [tor-relays] unflagged BAD EXIT nodes > > ?I'll hijack the response.... I'm a sysadmin, an unloved Windows one. My unwanted $0.02 are: > > - Windows installer (omg, Windows, the evil one which if you really want greater adoption is the answer! Oh smokes, someone said it! I agree that relay installers, particularly for non-Linux platforms, would help increase Tor's platform diversity. But platform diversity isn't a large part of Tor's threat model, as its impact is mainly felt through vulnerabilities shared by an entire platform. Currently, it looks like 90% of the Tor relays are Linux, by count of relays. (I believe the weighted bandwidth statistic is much higher than 90%.) https://metrics.torproject.org/platforms.html One suggestion I've heard, but that isn't ideal, is to download the Tor Browser Bundle, and modify the torrc in it to run a relay. That said, a relay operator really needs to know how to download, install, and configure a service on a secured server. So that's one reason a one-click installer is a bad idea. > - change the architecture so running behind nat works (this is probably the #1 limit factor for increasing relays). Every tom, dick, and harry could then add bandwidth via every internet circuit. It would be insane! Tor relays run quite fine behind a NAT, as long as the NAT box handles the number of connections which tor makes. There's even src/tools/tor-fw-helper, which supports NAT-PMP and UPnP. It can be configured via the torrc option: PortForwarding 1 Or, you can configure your NAT box to forward ports yourself. Tim Tim Wilson-Brown (teor) teor2345 at gmail dot com pgp ABFED1AC https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 teor at blah dot im OTR D5BE4EC2 255D7585 F3874930 DB130265 7C9EBBC7

1 1

unflagged BAD EXIT nodes
by starlight.2015q2＠binnacle.cx 05 Jul '15

05 Jul '15

Could someone comment on why 15 exit nodes discovered to be sniffing and abusing login credentials have not been marked with the BAD EXIT flag? The research appears to be legitimate, involved a good deal of effort, and seems credible: https://chloe.re/2015/06/20/a-month-with-badonions/ was blogged by Sophos, also credible https://nakedsecurity.sophos.com/2015/06/25/can-you-trust-tors-exit-nodes/ Is there an issue of trust w/r/t this security researcher? An issue of methodology and/or reproducibility? A shortage of resources to follow up? An investigation attempting to identify the operators? The researcher writes that they received a polite reply from and was summarily ignored with no further comment. AND the exits continue to steal and abuse credentials. If true this would be contrary to the inclusiveness generally exhibited by the Tor Project. IMO a likely password-stealing exit should be marked-first, questions asked later. If some kind of mix-up or mistake has occurred, a good operator should readily be able to defend themselves and not feel ruffled for it.

7 11

Re: [tor-relays] unflagged BAD EXIT nodes
by starlight.2015q2＠binnacle.cx 04 Jul '15

04 Jul '15

At 10:04 7/4/2015 +0200, nusenu wrote: >I find it more worrying that we do not "hear" >about the 'more serious attacks' that keep >them busy and don't allow them to look into >i.e. 'AviatoChortler' (even after a few >weeks). That might mean that there is a >constant stream of 'more serious attacks' >(without information I can only guess). Here is one where 70 bad exits were rewriting an .onion address on a clearnet portal and sending a Tor email service's users to an evil onion clone: https://lists.torproject.org/pipermail/tor-talk/2015-April/037549.html I can see the argument for ignoring the near-zero-ranked exits (as they will virtually never be used) and the massive BW password stealer (due to the value of the bandwidth and the fact that HTTPS is immune to passive sniffing). But am concerned Chloe apparently received mute indifference as her contribution to the project is significant.

1 0

Re: [tor-relays] Simplifying ExoneraTor
by Magnus Hedemark 04 Jul '15

04 Jul '15

tor(a)dserrano5.es thus spoke: > Results: do we really need the "Exit: yes" column? Seems pretty redundant to > me. How so? All exits are relays, but not all relays are exits. And if a relay is only configured as an exit for part of the time, that's a potentially important part of the historic record. Sent from [ProtonMail](https://protonmail.ch), encrypted email based in Switzerland

2 1

de-centralised bad exit list files - a bad and/or naive idea ?
by Toralf Förster 04 Jul '15

04 Jul '15

Reading "[tor-relays] unflagged BAD EXIT nodes" /me wonders, such a feature would makes sense. Technically this could yield to a ./torrc.d config directory, where tor users could store the (regular updated) list/s they do trusts. -- Toralf, pgp key: 872AE508 0076E94E

3 2

turned on statistics
by starlight.2015q2＠binnacle.cx 01 Jul '15

01 Jul '15

It looked interesting so I turned on EntryStatistics 1 ConnDirectionStatistics 1 HiddenServiceStatistics 1 in addition to the default DirReqStatistics 1 and the output is indeed interesting. Also have CellStatistics 1 though this information does not seem to be published in the ExtraInfo digest. Any reason why having any of these enabled might be a bad idea? Running 0.2.6.9.

1 0

How to create HSDir on a private network
by Ceysun Sucu 01 Jul '15

01 Jul '15

Hi, I'm currently trying to simulate a tor network on shadow to test out some properties of hidden service's, i was wondering how could i create a hidden service directory or if someone could point towards an example configuration. Thanks, C,Sucu

3 2

Tor handshaking
by Adrian Soh 30 Jun '15

30 Jun '15

My ISP slows handshaking (circuit initialization) severely. Are there Torrc settings or changes to Orbot (Android) that I could use?

2 1

Re: [tor-relays] A bridge too far
by jchase 29 Jun '15

29 Jun '15

Thanks, isis, for your answer. I restarted my bridge without the flags and it's been running 7 days and still no stable flag back. Any experiments you can suggest? -J Chase > jchase transcribed 0.8K bytes: >> Hello, >> Can anybody help me figure out why my bridge has stopped showing the >> flags fast, running and stable? Especially stable, I would love to get >> that flag back. I run two bridges, on two different Rasp Pi's, the one >> with a globe fingerprint of B08284109C72C81ACF5866A17A4CC64CE3E16499 . >> The other with a globe fingerprint of >> 1BCD3EBEFE17EEB86EEDE21D5E2DB8468E2864CF . The first bridge runs with >> obfs 3 & 4 on a Pi 2. It seems I lost the stable flag around the time I >> got obfs 4 up and running. The second bridge runs only with obfs 3 on an >> older Pi. >> I've read that the stable flag is quite handy. Any ideas about how I can >> get it back? >> Greetings, >> J Chase > > Hi J, > > Your bridge B08284109C72C81ACF5866A17A4CC64CE3E16499 appears to have a current > uptime of about 50 hours, and to have the Stable flag, according to > dir-spec.txt, [0] it must have: > > "Stable" -- A router is 'Stable' if it is active, and either its Weighted > MTBF is at least the median for known active routers or its Weighted MTBF > corresponds to at least 7 days. > > Meaning that you probably just need to let the bridge run for a few more days, > and it'll get its Stable flag back. > > Also, for what it's worth, BridgeDB will still distribute your bridge, even if > it doesn't have the Stable flag. The only required flag for your bridge to > get distributed is the Running flag. However, you are correct that having the > Stable flag is useful, because BridgeDB, when distributing some bridges to a > user, will try pretty hard to make sure that at least one of the bridges has > the Stable flag. So, with the Stable flag, you've got a better chance of > being distributed to clients more often, but it's not strictly necessary to > have it, especially for a bridge like yours with small bandwidth and CPU. > > [0]: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt?id=26929b8c5554… >

1 0

Re: [tor-relays] More consensus weight problems
by Aaron Gibson 29 Jun '15

29 Jun '15

On 2015-06-29 17:51, Speak Freely wrote: > Hello, > > First of all, I love Tor. I love Tor Browser, and I love running > relays. > > When the problems are solved, I will most likely spin up more relays. > > I'm leaving my fastest relay running, as a method of checking the > status > for myself. The rest have already started to expire, and within the > next > week or so most of the other ones will have expired as well. > > I'm going to try tor-dev-alpha 2.7.1 and change fingerprints, as per a > suggestion from s7r, seeing as how I have nothing to lose. > > I just wish the bwauths could scan relays based off previous relative > consensus weights... If this particular relay was at 27000, it should > be > higher on the list to check compared to another one I have that is at > 487. My one relay was blazing fast with thousands of connections, my Well, relays are ranked by capacity, and split over several scanner processes - they do get measured against their relative peers. But it seems that, when they fall out of the measurement process ('Unmeasured') they must start again at the beginning. This is expected because all relays start Unmeasured, and gradually increase their position in the consensus (per relative capacity), in order to dampen sudden changes and limit sybil attacks by requiring relays to stick around for a while, increasing the cost to an adversary. It likely should not be the case that historically long running relays should start at the bottom if they are unmeasured for a short period of time. We are in the process of testing increasing the number of scanner and accompanying tor instances from 4 to 9 (double, plus one for currently unmeasured relays) in order to decrease the amount of time each fraction of the network takes to measure and ensure that new relays or unmeasured relays are measured often. There are additional patches that introduce extra exits into the slice of relays, if there are no suitable exits to measure with. This likely won't address the above behavior, but we hope it will reduce the number of relays that go missing. Currently we seem to have mixed results, with one Bandwidth Authority operator claiming minimal (50) unmeasured relays, and another claiming ~600 mixed relays. These numbers are not directly comparable because they were not sampled at the same time, and may not be representative of typical behavior - it's a little too soon to tell. It's a bit tricky to both test these changes, on the live tor network, demonstrate that they produce sane results, and convince the directory authority operators and partner bandwidth authority operators to upgrade - nor do we want to do that all at once - gradual change is better. So, the goal is to produce results that will convince operators they should update, improve the situation for relay operators, and then start looking at longer term solutions for the measurement problem that are more maintainable and scalable in the long run. > other is painfully useless with dozens, but my fastest one lost its > consensus while the slowest one kept it's consensus. It just seems > silly. That being said, I don't know how/if the bwauths scan in any > order or just willy-nilly, (that's not entirely true, I know it's > segmented to some degree as I recall reading a blog post about how it's > chopped up) but... I'd be much less upset if my best relays worked and > my worst relays didn't. More complaining... bleh. > I hope to have a testable hypothesis as to why your faster relays suffer(ed) more than the slower relays - it could be that the fraction of network by capacity allocated to a particular scanner is not well balanced, and that fraction is taking significantly longer to measure. In order to evaluate that statement I need to understand the common characteristics of relays that become unmeasured/lose rank and see if they are from a similar segment of the network, and whether or not that segment of the network takes longer to measure than other segments. Another hypothesis is that your relays are on the boundary between two segments, and that a transition between scanner instances causes enough missed measurements to drop your relays. It would be helpful to know what rank the last good measurement your or other relays had before becoming unmeasured. It will require some cooperation with the existing deployed Bandwidth Authorities, in order to learn what their current scan times are - I will be writing some simple scripts to scrape these results so that we can collect and publish some useful heuristics about the scanner processes to better try and debug this problem. > > One thing I would like to point out though... it appears... These > problems have at least a casual relationship with MyFamily. > > One group of MyFamily is completely done - all of them stuck at 20. > Another group of MyFamily is working happily. > I've been doing some tests over the past few months trying to > understand > why I keep having problems, and one thing has consistently popped up... > MyFamily. That is very interesting, because MyFamily should have nothing to do with the scanner process at all - I'll need to think about this some more. > > As one of MyFamily lost consensus, another family gained consensus back > on or around the same time. > > Yes, especially nusenu, I know I'm supposed to have it all configured > to > be under 1 MyFamily... But in a way I'm glad I didn't, as the casual > relationship I see really could only be seen having done what I did. > > I say casual because I have no proof of causation. But... it is > interesting. If no one else has experienced similar problems, then I'd > chock it up to a completely unexpected unrelated set of mysterious > circumstances that should not have happened for which there is no > explanation. > > Aaron, if there is anything I can do to help you please let me know. If anything that I said above sparks a thought, please let me know :) > > > So in conclusion, I'm not done, I'm just not happy. > > This was supposed to be a short email, oops. > > > Matt > Speak Freely

1 0

default value (after reboot ) of controller.get_server_descriptor.uptime changed ?
by Toralf Förster 28 Jun '15

28 Jun '15

I do wonder, why a python script [1], lines 22 and 113, nowadays returns "00:00:00" for the uptime of my exit relay, when the system was rebooted, whereas in former times '00:01:01' (= 61 sec) was returned. FWIW the only local change before reboot here was to switch from Gentoo hardened kernel 4.0.6 to 4.0.6-r1. [1] http://www.zwiebeltoralf.de/pub/info.py -- Toralf pgp key: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 0076 E94E

2 1

be in time or not to be in time ?
by Toralf Förster 28 Jun '15

28 Jun '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hhm, found this in the log: Jun 28 03:58:37.000 [warn] Our clock is 1 minutes, 23 seconds behind the time published in the consensus network status document (2015-06-28 02:00:00 UTC). Tor needs an accurate clock to work correctly. Please check your time and date settings! NTP runs fine at this exit relay since months, and I found nothing in the log which would tell me that sth was wrong with the time. Any hints / explanations ? - -- Toralf pgp key: 7B1A 07F4 EC82 0F90 D4C2 8936 872A E508 0076 E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlWPuw0ACgkQxOrN3gB26U71+wD+PIH6JSVqR8SJ/43wwDZKNibH UdvUWwDG4eQQ5kn/3N4A/AydwluUvBMXXSy7fh+Zphg1dCUF+zq7jKmxzRYcAZ2A =bnzu -----END PGP SIGNATURE-----

2 2

More consensus weight problems
by Speak Freely 27 Jun '15

27 Jun '15

Just thought I'd throw it out there. About 5 days ago I setup a new relay - it's consensus weight is still at 20. Then, I noticed a relay I've been running for about a month all of sudden lost all of it's consensus weight. It was ~17000, now at 20. It's uptime is 25 days, and has downloaded 4.8TB and updated 5.0TB in that time. Normally, when I have a consensus weight of 20, I also see a measured speed in arm of 160b/s. However, my month old relay's measured speed is showing 136.7Kb/s. This relay was averaging 15-25Mbit/s up until today, but now jumps between 600Kbit - 8Mbit, but mainly between 800Kbit-2Mbit. My other relays with the same provider have not experienced this, nor have my relays with different providers. Just this one. The interesting one: https://atlas.torproject.org/#details/D60B02A13F5D9CAFD6EC27A5332C5FEF5B769… Matt Speak Freely

4 6

circuit_unlink_all_from_channel
by Logforme 27 Jun '15

27 Jun '15

FYI I run the relay 855BC2DABE24C861CD887DB9B2E950424B49FC34. Today I found a message in the log file I have not seen before: Jun 26 18:05:20.000 [warn] circuit_unlink_all_from_channel(): Bug: Circuit on detached list which I had no reason to mark Relay continues to run fine with 30 days uptime.

2 1

Re: [tor-relays] No Exit flag on Exit node
by spiros_spiros＠freemail.gr 25 Jun '15

25 Jun '15

Aha thank you, so simple! I will make the changes. Spiros Στις 25 Ιούνη, 2015, στις 19:18, ο Tom van der Woerdt <info(a)tvdw.eu> έγραψε: Hi, You need two of the ports [80,443,6667] allowed to get the Exit flag. Of these, your exit configuration only allows 80. Tom spiros_spiros(a)freemail.gr schreef op 25/06/15 om 20:19: Good evening all, An exit that I have been running for over one month now has not yet achieved the Exit flag in arm/atlas (I know it is working because regular spam/hacking/abuse emails I am receiving). I though this was related to recent bwauth issue, but have concerns now because the exit now has a Guard flag. I think the problem will lie in the torrc and some mistake in the config. Please can I ask for some advice on where the mistake might be? I have pasted torrc below, with sensitive information changed in the brackets <>. Thanks very much Spiros #:~ cat /etc/tor/torrc RunAsDaemon 1 DataDirectory /var/lib/tor ControlPort 9051 CookieAuthentication 1 ORPort 443 ORPort [<<valid IPv6 address>>]:9090 Nickname <<nickname of this exit>> RelayBandwidthRate 10 MB RelayBandwidthBurst 12.5 MB DirPort 9030 DirPortFrontPage /etc/tor/tor-exit-notice.html MyFamily <<nicknames of other exits and relays>> ExitPolicy accept *:20-23 ExitPolicy accept *:53 ExitPolicy accept *:79-81 ExitPolicy accept *:88 ExitPolicy accept *:110 ExitPolicy accept *:143 ExitPolicy accept *:1194 ExitPolicy accept *:5900 ExitPolicy accept *:8008 ExitPolicy accept *:8080 ExitPolicy accept *:8082 ExitPolicy accept *:8332-8333 ExitPolicy accept *:50002 ExitPolicy reject *:* ExitPolicy reject6 *:* IPv6Exit 1 DisableDebuggerAttachment 0 _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays _______________________________________________ tor-relays mailing list tor-relays(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0