- tor-relays - lists.torproject.org

Relays alongside firewall
by Jan Nielsen 26 Oct '14

26 Oct '14

Hello. I recently enabled UFW on my relays. I have allowed in all necessary ports that my relay uses. I was looking at the logs and there are plenty of blocked incoming TCP connections. These connections are being blocked because they are attempting connection on ports that I have not opened e.g. 9001. However, the traffic appears to be relay traffic. Is ufw interfering with my relay? Are there additional steps to take when running a relay alongside a firewall? Here is a redacted snippet from my ufw log: Oct 26 15:10:29 [UFW BLOCK] IN=eth0 OUT= MAC=04:01:26:15:5a:01:xx:8a:xx:64:xx:f0:xx:xx SRC=202.108.xxx.xx DST=178.62.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=46331 DF PROTO=TCP SPT=49892 DPT=34449 WINDOW=5840 RES=0x00 SYN URGP=0 Oct 26 15:10:32 [UFW BLOCK] IN=eth0 OUT= MAC=04:01:26:15:5a:01:28:8a:1c:64:cb:xx:xx:xx SRC=202.108.xxx.xx DST=178.62.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=46332 DF PROTO=TCP SPT=49892 DPT=34449 WINDOW=5840 RES=0x00 SYN URGP=0 Oct 26 15:15:12 [UFW BLOCK] IN=eth0 OUT= MAC=04:01:26:15:5a:01:28:8a:1c:64:cf:xx:xx:xx SRC=60.186.xx1.xx DST=178.62.xxx.xxx LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=19751 DF PROTO=TCP SPT=52502 DPT=34449 WINDOW=5840 RES=0x00 SYN URGP=0

1 0

Iptables dump
by Sebastian Urbach 26 Oct '14

26 Oct '14

Dear list members, I want to offer my iptables dump so that everybody who's interested can use it to fill up the firewall with the "usual suspects". My system basically runs just TOR and SSH, so it's not a big surprise that the file contains almost only ip's which attacked SSH. Iptables is fed by fail2ban and then dumped every hour iptables-save so that this collection is automatically loaded via iptables-persistent after a reboot. I will publish this file just once so that this list is not stressed too much. If there is a certain amount of interest i'm willing to offer the file for download permanently. Please contact me if you are interested in that. -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ----------------------------------------- Definition of TOR: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

1 0

Re: [tor-relays] BBC and UK Lottery blocking ip addresses running Tor
by Dan Hanley 26 Oct '14

26 Oct '14

Hi Matt I was in the unusual position where www.bbc.co.uk decided I was not UK resident (I am) and redirected me to www.bbc.com - where none of the links worked for me as that site decided I was UK resident. The BBC did make it clear that they understand Tor relays should not be an issue for them, but that they consider exits to violate their terms of service. It would seem they have stopped discriminating against relays, I doubt they'll ever be exit friendly :-( Dan > > ---------- Forwarded message ---------- > From: Matt Puckey <matt(a)puckey.org> > To: tor-relays(a)lists.torproject.org > Cc: > Date: Sat, 25 Oct 2014 18:19:21 +0000 > Subject: Re: [tor-relays] BBC and UK Lottery blocking ip addresses running > Tor > Dan Hanley: > > Looks like the BBC have changed their rules. I am still running a relay, > > but can now access www.bbc.co.uk in a normal fashion. > > > > Still blocked by national lottery, but I'm hopeful that they both use the > > same third party ip checker, and that the next lottery update will fix > the > > issue. > > Progress! > > I cried a little inside when I read, "We have asked our provider to give > us a way of differentiating Tor exit nodes from non-exit relays, to > allow us to block exit nodes only." > > Ugh. > > Did you have trouble reaching www.bbc.co.uk as well as iPlayer? That > would be strange. I haven't seen them block Tor relays & exits simply > getting to www.bbc.co.uk. > > --Matt > > > >

1 0

Re: [tor-relays] My VPS relay has just been hacked
by Libertas 26 Oct '14

26 Oct '14

For what it's worth, there's an operational security document on the Tor wiki: https://trac.torproject.org/projects/tor/wiki/doc/OperationalSecurity However, that document covers more advanced techniques mostly intended for serious attackers such as government agencies. Others have already mentioned to you the simplest options, which should keep you safe from automated botnet hackers. These include: allow only public key authentication on SSH, use fail2ban or sshguard, update frequently, and don't run anything unnecessary (a torrent client, an HTTP/FTP server). Some relevant links: https://help.ubuntu.com/community/SSH/OpenSSH/Keys (if you're only going to read/do one thing, make it this) https://www.debian.org/doc/manuals/securing-debian-howto/index.en.html#cont… -Libertas

1 0

Note: 0.2.3 is deprecated
by Nick Mathewson 25 Oct '14

25 Oct '14

And please forgive me or sending one more email, please let me call your attention to these bits of the Tor 0.2.5.10 release notes: This release marks end-of-life for Tor 0.2.3.x; those Tor versions have accumulated many known flaws; everyone should upgrade. o Deprecated versions: - Tor 0.2.3.x has reached end-of-life; it has received no patches or attention for some while. If you're still running Tor 0.2.3 on a relay, I'd strongly suggest you upgrade to 0.2.4, or to 0.2.5 as soon as it's available for your operating system. If there's some issue that prevents you from running a more recent version of Tor, please let us know soon so that we can try to address it before 0.2.3 becomes totally obsolete and gets rejected from the network. best wishes, and thanks for running relays! -- Nick

1 0

Oniontip
by Sebastian Urbach 24 Oct '14

24 Oct '14

Dear list members, Since i was the One who asked to put Oniontip on the tor-website (donate section), what is the current discussion status ? -- Mit freundlichen Grüssen / Sincerely yours Sebastian Urbach ----------------------------------------- Definition of TOR: 10% luck, 20% skill, 15% concentrated power of will, 5% pleasure, 50% pain and 100% reason to remember the name! -----------------------------------------

1 0

Re: [tor-relays] Unstable router
by humbletoruser＠Safe-mail.net 23 Oct '14

23 Oct '14

Hello, thank you all for your suggestions. From: Julien ROBIN <julien.robin28(a)free.fr> > Take another well known product from well known trademarks > Linksys, D-Link, Netgear, Sitecom, TP-Link, or something compatible with OpenWRT for example. Okay, I'm going to try a new router. I don't use VoIP or TV-Services. Just a Tor Node and a hidden Service.

1 0

If you've ever run one of the Tor Browser default bridges...
by isis 21 Oct '14

21 Oct '14

...then please have a look at #13504: https://bugs.torproject.org/13504 Thanks! -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://blog.patternsinthevoid.net/isis.txt

1 0

Advisory: remote DoS when using Tor with recent OpenSSL versions built with the "no-ssl3" option.
by Nick Mathewson 21 Oct '14

21 Oct '14

Hello, relay operators! There's one important bugfix in the 0.2.5.9-rc release that relay operators should know about. If you have a version of OpenSSL that came out last week (like 1.0.1j, 1.0.0, ) and if your version of openssl is built with the "no-ssl3" flag, then it's possible to crash your Tor relay remotely if you don't upgrade to 0.2.5.9-rc or to 0.2.4.25 (when that's out). This appears to be an OpenSSL bug. The Tor releases in question contain a workaround for it. To tell if your version of openssl was built with 'no-ssl3': run "openssl s_client -ssl3 -connect www.torproject.org:443". If it gives you an output beginning with something like: CONNECTED(00000003) 140632971298688:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1257:SSL alert number 40 140632971298688:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:596: then you're fine and you don't need to upgrade Tor on your relay. But if it says something that starts like: unknown option -ssl3 usage: s_client args then you need to upgrade your Tor. === Some questions and answers: Q: Does this affect clients? A: No. Only relays. Q: Does this affect me if I'm running a version of OpenSSL other than 1.0.1j, 1.0.0o, or 0.9.8zc? A: No. Only those versions. Q: Does this affect me if I'm running a version of OpenSSL configured without the "no-ssl3" option? A: No. Only versions that were built with the "no-ssl3" option are affected. Q: Does the openssl team know? A: Yes. Have a look at this thread. http://marc.info/?l=openssl-dev&m=141357408522028&w=2 . Also, before I saw that thread, I informed them the other day. Q: Does this affect Tor packages? A: I don't think that we shipped any packages where we used the "no-ssl3" flag to diable ssl3. So only if you're using OpenSSL from another source (say, your operating system) will you be affected. Q: What can I do to remediate this problem? A: You can upgrade to the most recent Tor, or you can use a version of OpenSSL built without the "no-ssl3" flag. Downgrading your OpenSSL is not recommended. Q: What is the potential impact of this bug? A: If a relay is affected by this bug, anybody can make the relay exit remotely. It does not enable any data leaks or remote code execution. Still, the ability to selectively disable relays might enable a sophisticated attacker to do some kinds of traffic analysis more efficiently. So, fix your relay if it's affected. Q: Should we run in circles and freak out? A: Not this time. We should just make sure we fix affected relays. Q: Hey, Nick, you didn't explain this properly! A: Please send a follow-up message that explains it better. :) best wishes, -- Nick

1 1

tor-relays on Nokia N900
by Franklin 20 Oct '14

20 Oct '14

Hi How to set tor-relays on Nokia N900?

1 0

Anonbox Project
by Sven Reissmann 17 Oct '14

17 Oct '14

Hi there, I recently read about the anonbox project [1], a small hardware-router, which allows end-users to connect their whole LAN to the Tor network. The project is on kickstarter at the moment [2]. Has there already been a discussion on how this might affect the performance of the Tor network? Regards, Sven. [1] http://anonabox.com [2] https://www.kickstarter.com/projects/augustgermar/anonabox-a-tor-hardware-r… -- PGP Key: https://0x80.io/pub/files/key.asc PGP Key Fingerprint: 2DF2 79CD 48DD 4D38 F0B6 7557 2E68 D557 49AA 1D99 Note: I'll be transitioning away from this key in the near future.

15 20

Re: [tor-relays] Few questions about relaying
by teor 17 Oct '14

17 Oct '14

Unless you have a specific need to debug tor (hint: you don't), you should remove this line to improve security: DisableDebuggerAttachment 0 And please consider adjusting these lines rather than removing them: RelayBandwidthBurst 25 MBytes RelayBandwidthRate 20 MBytes We've found that relays perform best when given a rate slightly under the capacity of the link. teor pgp 0xABFED1AC hkp://pgp.mit.edu/ https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 http://0bin.net/paste/Mu92kPyphK0bqmbA#Zvt3gzMrSCAwDN6GKsUk7Q8G-eG+Y+BLpe7w… On 12 Oct 2014, at 01:22 , tor-relays-request(a)lists.torproject.org wrote: > Date: Sat, 11 Oct 2014 17:21:51 +0300 > From: s7r <s7r(a)sky-ip.org> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Few questions about relaying > Message-ID: <54393CFF.5030903(a)sky-ip.org> > Content-Type: text/plain; charset=ISO-8859-1 > > Signed PGP part > RelayBandwidthBurst 15 MBytes > RelayBandwidthRate 3 MBytes > ContactInfo QuebecFibe(a)gmail.com - 200Mb dedicated relay > ControlPort 9052 > CookieAuthentication 1 > DataDirectory /home/blaise/.arm/tor_data > DirPort 9030 > DisableDebuggerAttachment 0 > ExitPolicy reject *:* > Log notice file /home/blaise/.arm/tor_log > Nickname QuebecFibe > ORPort 27645 > RunAsDaemon 1 > > > Use this. You are using the latest Tor? > > > On 10/11/2014 5:11 PM, Blaise Gagnon wrote: > > http://pastebin.com/DQ4k7Fzz > > > > 2014-10-11 10:06 GMT-04:00 s7r <s7r(a)sky-ip.org > > <mailto:s7r@sky-ip.org>>: > > > > Can you please copy/paste your entire torrc to a pastebin and > > provide us the link? > > > > It is hibernating only if you use accounting. Provide us your > > entire complete torrc and we will correct it for you if you don't > > have traffic limits on your server. > > > > On 10/11/2014 4:54 PM, Blaise Gagnon wrote: > >> after a few hours, still hibernating, and still wondering why I > >> lost Stable, Guard and Named all at the same time (see atlas > >> graph)... weird. > > > >> 2014-10-11 6:03 GMT-04:00 Blaise Gagnon <quebecfibe(a)gmail.com > >> <mailto:quebecfibe@gmail.com> <mailto:quebecfibe@gmail.com > >> <mailto:quebecfibe@gmail.com>>>: > > > >> no reason for my node to be hibernating, no caps... > > > >> 2014-10-11 3:31 GMT-04:00 Lunar <lunar(a)torproject.org > >> <mailto:lunar@torproject.org> <mailto:lunar@torproject.org > >> <mailto:lunar@torproject.org>>>: > > > >> Blaise Gagnon: > >>> and ... what is "hibernating" ? > > > >> See AccountingMax and related options in tor manpage: > > > >> AccountingMax N > >> bytes|KBytes|MBytes|GBytes|KBits|MBits|GBits|TBytes Never send > >> more than the specified number of bytes in a given accounting > >> period, or receive more than that number in the period. For > >> example, with AccountingMax set to 1 GByte, a server could send > >> 900 MBytes and receive 800 MBytes and continue running. It will > >> only hibernate once one of the two reaches 1 GByte. When the > >> number of bytes gets low, Tor will stop accepting new connections > >> and circuits. When the number of bytes is exhausted, Tor will > >> hibernate until some time in the next accounting period. To > >> prevent all servers from waking at the same time, Tor will also > >> wait until a random point in each period before waking up. If you > >> have bandwidth cost issues, enabling hibernation is preferable to > >> setting a low bandwidth, since it provides users with a > >> collection of fast servers that are up some of the time, which is > >> more useful than a set of slow servers that are always > >> "available". > > > >> -- Lunar <lunar(a)torproject.org <mailto:lunar@torproject.org> > > <mailto:lunar@torproject.org <mailto:lunar@torproject.org>>> > > > >> _______________________________________________ tor-relays > >> mailing list tor-relays(a)lists.torproject.org > >> <mailto:tor-relays@lists.torproject.org> > >> <mailto:tor-relays@lists.torproject.org > > <mailto:tor-relays@lists.torproject.org>> > >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > > > > > > > > >> _______________________________________________ tor-relays > >> mailing list tor-relays(a)lists.torproject.org > >> <mailto:tor-relays@lists.torproject.org> > >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > > > _______________________________________________ tor-relays mailing > > list tor-relays(a)lists.torproject.org > > <mailto:tor-relays@lists.torproject.org> > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > > > > > > > _______________________________________________ tor-relays mailing > > list tor-relays(a)lists.torproject.org > > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > > > > -- > s7r > PGP Fingerprint: 7C36 9232 5ABD FB0B 3021 03F1 837F A52C 8126 5B11 > PGP Pubkey: http://www.sky-ip.org/s7r@sky-ip.org.asc >

2 1

Unstable router
by humbletoruser＠Safe-mail.net 16 Oct '14

16 Oct '14

Hello guys, I'm hosting a tor relay at home. My router is a Fritz-Box (this one: http://avm.de/service/fritzbox/fritzbox-7362-sl/uebersicht/ ) and the internet connections is really unstable. Frequently the connection breaks. Not only to the internet, also the local network is down till the router reboots. Is there a better solution for routing a DSL connection? A better router or a way to replace the router with the computer running the tor node. Any hint is appreciated. Thanks in advance! Another question: If I'm acessing my side through a .onion address theres no need for ssl/https as the traffic is encrypted anyways, right?

4 3

About TBB downloadings
by Lluís 16 Oct '14

16 Oct '14

In the web page here: https://www.torproject.org/download/download.html.en#warning advises us not to "... open documents downloaded through Tor while online" Many technical manuals and scientific papers are written in pdf format, and I usually read them. So my question is: Is it safe to download them with TBB first and then open them with, say, "Document Viewer" ? Where can I find more information about it ? Lluís, Spain

4 7

Obfuscated bridges and tor-arm
by justaguy 16 Oct '14

16 Oct '14

Does the tor-arm tool display the used BW of the obfuscated bridge or only the normal non obfuscated bridge? -Justaguy

2 1

About bug #13256: "torsocks 1.3 possibly leaks username"
by Pablo Castellano 16 Oct '14

16 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello! I reported this bug some weeks ago but I haven't received any answer: https://trac.torproject.org/projects/tor/ticket/13256 I'm bringing it here to discuss it and know your thoughts. Regards, Pablo. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBAgAGBQJUPxOMAAoJEHj0TzpGP5Gc/9MQAJF2wzKy5DEvKr90RJDSLphF /2HvBGFZyJDhusDKbwPPGujGqSpbv0f5RL2ZBZ7wFXt0TBo95q3LXiwpwux4jThl bn/smPKw6sLRiCs4/mNGlF17yxX35RrhXOiXtu5xk828zRT2qsE2ZaChH81Ynkml IAsidwdh6B3MzFa/vd1rXngoBJZNAoMn2WvVR7vZJAk9ttcCO8qVYocQje/M0QrR xVn1Aw3+Ao436KCdqu6yAjfgr7NLIwGEZI+Q19BNukuQLdOzydixdB9IAUDfXER6 XL0uPO2T6WgzdTGq8tqAc+x5CPkNeeNqRHa9Cx72gVIxdkBAtZfMlv3c1ulYfM0/ FexxuIlsmF4Ei7HsKWf/c7C0bir1wwJhWFrM8hpQHkpOyWAHQWFjaW0x/xuzU/03 Icxf9U/D92C24XmJJrPI4dIS1F2EYdoOWtrd62UacExeuwRhLb4D2FC2VamCjCYq SN9czti8MuS/Jmqq7vNI3wkcZzZ0x5r/ECYncHdC9P3MQN+JfbU5ei0bU0LOQNE/ sNRdERHymNcv5HHQC3NU+gGx4yf56GO9R6natZC78OrXwu2RroCGEjeMhq/pMe5R CG0eZHPN993pY9UdlMivsfrKnH0McZPSJ2b/NnyxLdYfK58s68hM14ypM4VVUrNT z7zgr/qYtLHzj0EWT9Y7 =D6IQ -----END PGP SIGNATURE-----

2 1

Re: [tor-relays] Anonbox Project
by Torzilla 15 Oct '14

15 Oct '14

I have seen their website and it looks like someone is trying to sell this product though I didn't see a price tag yet. Looks dangerous. Possibly a honeypot. Thanks, Torzilla11 Sent from my Sony Xperia™ smartphone Thomas White <thomaswhite(a)riseup.net> wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >Well the topic has come up several times in the last day or two on IRC >and generally the feeling is that it may be quite bad for the users of >the product, not necessarily the Tor network however. > >One thing that AnonBox does do is increase Tor network traffic - you >can see this as both good and bad since it adds load to exit operators >like myself which are already in short supply and diversity, but at >the same time adding traffic to the network makes it safer to use for >everyone. > >The real concern is the mismarketing and borderline fraud occuring by >assuming the simple use of a protocol or open source software (which I >note, the hardware is not actually open source at all). In addition, >the users of such a system are going to be leaving an enormous browser >fingerprint and their activities will be correlated so expectation of >reasonable privacy from this project is a misguided hope at best; at >worst very dangerous to life and limb of anyone who relies on Tor for >their life. > >I am personally hoping somebody high up in the Tor Project management >will openly condemn this atrocity and hopefully Kickstarter and the >funders will withdraw their funds before a whole load of people buy >into this "security as a tool" idea. > >- -T > >On 15/10/2014 12:15, Sven Reissmann wrote: >> Hi there, >> >> I recently read about the anonbox project [1], a small >> hardware-router, which allows end-users to connect their whole LAN >> to the Tor network. The project is on kickstarter at the moment >> [2]. >> >> Has there already been a discussion on how this might affect the >> performance of the Tor network? >> >> Regards, Sven. >> >> >> [1] http://anonabox.com [2] >> https://www.kickstarter.com/projects/augustgermar/anonabox-a-tor-hardware-r… >> >> >> >> >> _______________________________________________ tor-relays mailing >> list tor-relays(a)lists.torproject.org >> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays >> >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v2.0.22 (MingW32) > >iQIcBAEBAgAGBQJUPmHuAAoJEE2uQiaesOsLAOMP/j8BHqO2yIHRV8Q7Ja3aYHrv >ppLrDbjvbkV9paqGR4X8Gz71PJyHXZoOse6JfBxOnZG+mmoS9elYoXDkKoz8y5Z3 >ot/cpoQdKLei+LvmRxQ5VHcwDXx6wb35+o7I5FnvMoyH2YTeqyfAmGnb5X7D3oa7 >H5rYF8n17ttfvqHvFt2tRuZKKyskJWRnjnpkmmAJSeZpmZnRf38JGhdknmoPMXg3 >5hwzh7E9xFSMM5NrCpXDYvRdZJMvQPWdDFOVUZvKMh/magJitfBZ2Lr7cpq2Vpep >bU8Xs4z/a92j+bm3lN1jzUEgoxs7BEtn/bG2ASRJp2BufOFW8+FCTuOJQPVV0iSa >BPtjoNGe1cwBin256ODF3GjcuzS0Vbql0oS3HyYyEgYEnDjXcw05sdd9tg9i1lqk >66M8h9/aQvZZX1qB4EPzweOYM10VX7mS2pGGl+00wGkGZvhZ4k5ixP/8kHQ7OqQh >d6lwg/ZWK+6wYx3ADCKCvfD5pCNMlf4AtWgam3eQpSPw1uJuw3/twKEvuQijfhRM >XyNu3GivErIpL1d9awm0tJdqcZYZsKw/RFKN9leHt8PhYTMcSp+MViPuFaPIcYh0 >CHwj36gQTqB3XxzdnyJyzigwQhpWePs+qcmc4S3mTq8ogZsnBMgS080XocOx1Jrp >zqZfg7sOGY+s3018nntK >=SX0h >-----END PGP SIGNATURE----- >_______________________________________________ >tor-relays mailing list >tor-relays(a)lists.torproject.org >https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

1 0

GoodBadISPs revamp?
by subkeys＠riseup.net 15 Oct '14

15 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 [cross-posted on tor-talk and tor-relays] i've found that the Tor GoodBadISPs list [1] is somewhat outdated on current hosts that allow Tor (exit) relays to be hosted. i'm trying to find a cheap host that allows exits to be operated from their services, and navigating the outdated list and finding an operator that isn't extremely expensive is time consuming (some entries go back to 2010!). should the community start a revamp project (or start a whole new list)? i'd be willing to donate my time to help get this started if need be. thanks. - ---- mikael ball 0xB1910271AE8587F4 @subkeys [1]: https://trac.torproject.org/projects/tor/wiki/doc/GoodBadISPs -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUOyMfAAoJELGRAnGuhYf0BKIP/jW0D+wgMOMrYlFQ9k46fHTK g57tkqp6SAKPL/us6Zgf1tG3XIxUGcsQXTt9xrRwgpBAC1iEJtQcBGVutd6hCtYn s3ByxR1fhHa7LglDISueiDTsSx7/cu0cGykKbT7xxGSBLXint0tVxyis/GAznIue MoIlwCoFBO6rHsDU+aPyfLk0SjpYaDZ2tI3PKVplWO/NCW7UHiDeMONPfTXQxVQQ XYSl7Mp2AhmdatpU2a7ACXi1qWibFRlJqVji/Hp3wVpDYxGGIGxP1RG7vR+JvoqU wZ0g0s9JTRpNpjKfLlHGs8ZxF1XXFGXkpqYR9Ka1lAvkD50EFHbQshMKD6exGnfY xyNrEaleCTB+w3ww4YMPqRCzd3J5a/6+xdncBEitV5YzKh15aYD4VJk0/vlFVbED 950Zsh+6n242fwCAXRZi59rbmL3TRqkqNsM3Ihp8z6RyNSf5IwkFf/8TQXIFZ5xy ieNTtnFljinTDgScBjwSh0yvpQTuSL1doG8Uw5Gj3OAWVZWUnb/qrE6GGXY7cjHl 3KsPDr7/wMLF73kDc8TkcUPYcQkC3THXRB40qapSucB0utKZMfBWbczkZLu+JXxb aBLVqd9HKBhqyRsp5Y9yaCFYgWbIwssGYhgY+qi/vgr0y3aedP1A2Y0rhyyYUJAt wBRikkm58YQfotoN0o5H =YSqt -----END PGP SIGNATURE-----

9 11

Slow relay speeds for Australian geographic location(s)
by Mathew 13 Oct '14

13 Oct '14

Hello all, I run a non-exit relay in Australia. My relay has been running for almost 15 days and has seen very little traffic. I have a 100/40 fibre connection and bandwidth is set at 2MB/s and 2.5MB/s burst. The mean read/write is 3.22kb/s and the advertised bandwidth constantly varies between 100-800kb/s which is obviously a fraction of my available bandwidth. Do relays located in less tor frequented countries see much less traffic or something? I have ports set at 443 and dirport 9030, is this an optimal port setting? Anyone with helpful information would be appreciated. My relay is 1337m8 if anyone wants to look at the traffic. Thanks

4 4

New error message
by Paul Blakeman 13 Oct '14

13 Oct '14

Hi all This has started appearing in my notices.log Can anyone shed any light please? Oct 13 12:04:05.000 [warn] Unexpected sendme cell from client. Closing circ (window 1000). [3 similar message(s) suppressed in last 600 seconds]

2 1

Re: [tor-relays] GoodBadISPs revamp?
by mikael ball 13 Oct '14

13 Oct '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 had to create a new thread because i had digests turned on. oh well. On Mon, Oct 13, 2014, Thomas White wrote: > As a community I think we should also be more transparent in > communications with the ISP's in question. For example, rather than > stating a yes/no instead we find a tidy way to paste their exact > response and link it in the table so we know exactly who they talked > to, waht their question was and the reason they disallowed it. i agree with this. in addition, we should ask for all of the ASN and/or IP blocks from the customer service reps, query onionoo for nodes running within those and display a list of them. (how?) in regards to the EFF partnership idea: i support this. getting the name of a respectable entity who has experience in PR (what kind?) might help with getting the ISPs on board. - -- mikael ball 0xB1910271AE8587F4 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJUO0GdAAoJELGRAnGuhYf0KbMP/RWYW8P5wkY2pZwV6pARoQOq i9C5RH+AXXceihZEdaxF5kXMaXGA3Xndck74DZ8O06dEmJzztMBFqR6342qgOwe0 d+oyb2DjCQPd8d/FJEPwrgJKcyKSi3EDgJt7KqUA7bMbcyh3cn4s+clVQzCeYkZK TWuzv2gzOUdL05t+N0MTAQG4tTCaFSH1Y3cC4zca764kAreds4DLRX/Ju4+wYUBe QdlxpKl11o6x7LF1nT7kNsxGdNY9VB5t6mbWDDjIBRA6lCbIIvAfqajDB9yuAqy8 yY230fhZ1PU4eU+eJdsxh3U9yI4t3Z5dKeKI0LAHe8agNoLP6IqmWJRV2odri/vb U7BpuY9v5zpQ5gs4U7ppwtgIWagdXe1YC4ULpdabW09InVnC2D0u6/ncUu7gVg08 2qIf+kWxLItaNVJr+4xH1tsJZfNuTK6sUjDm43LJP9WH9nuiveiLo+7MGb5vf1Aw PfdghSA+8J291hJv8X51SmvgEgl9b6SeV4WyBQQVsyFcomjOpBIQmXLt0+D1BhUd G7WNfRf584Ts372Brmtf8UfZqT0niMaHh3BEg14NvCpnaKZ8X8mwRSMHreaIvSpr /wlV8Dy62rpqcsrqp7srLYSsPA9AOP6DsHl52qEjZ4cbeSPY6/ir+RDXn1nJ3BHx 51PhadTMMRybDbNfv1Xv =Xniq -----END PGP SIGNATURE-----

1 0

Re: [tor-relays] Question on running bridge nodes
by teor 12 Oct '14

12 Oct '14

On 12 Oct 2014, at 09:32 , tor-relays-request(a)lists.torproject.org wrote: > Date: Sat, 11 Oct 2014 23:25:47 +0100 > From: Tor externet co uk <tor(a)externet.co.uk> > To: tor-relays(a)lists.torproject.org > Subject: [tor-relays] Question on running bridge nodes > Message-ID: <49c1abc0aa88e1bf8425fdc8e482402d(a)nodataavailable.com> > Content-Type: text/plain; charset=US-ASCII; format=flowed > > Hi, > > I've set up a bridge node in the previous few weeks, but have had to put > a bandwidth limit on, as I only have 10TB of traffic per month before my > ISP will start throttling me to 100k/sec. > > I wondered whether it was more helpful to the Tor network as a whole to > have have a very fast node which hibernated every 12-15 hours, or if I > throttled Tor traffic, so that the node was more stable. > > I'll confess that I'm far more au fait with the politics of Tor than I > am of the exact ins and outs of how the technology works. Any help would > be gratefully received. > > Thanks > L For relays, where pathing is quite dynamic, we recommend speed + hibernation over uptime. But for bridges, users obtain only 3 bridge descriptors at a time, usually via some difficult or dangerous method. We'd want to make sure at least 1 stays up at all times (2 for reliability), which would favour throttling. teor pgp 0xABFED1AC hkp://pgp.mit.edu/ https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 http://0bin.net/paste/Mu92kPyphK0bqmbA#Zvt3gzMrSCAwDN6GKsUk7Q8G-eG+Y+BLpe7w…

2 2

Re: [tor-relays] Slow relay speeds for Australian geographic location(s)
by teor 12 Oct '14

12 Oct '14

On 12 Oct 2014, at 18:06 , tor-relays-request(a)lists.torproject.org wrote: > Date: Sun, 12 Oct 2014 18:06:42 +1100 > From: Mathew <wired.kid(a)gmail.com> > To: tor-relays(a)lists.torproject.org > Subject: Re: [tor-relays] Slow relay speeds for Australian geographic > location(s) > > Thanks for the in depth post, Teor. I had read the lifecycle article but > was concerned when people were posting that their relay was soaking all > their bandwidth after a day or two. This makes sense now, given the > oversupply and location. It was also worrying when the advertised bandwidth > was fluctuating so much and was only advertising a fraction of what > actually is available. > > The Windows server is using very minimal resources at the moment, and TCP > connections are around 250. The router will definitely be able to handle > the load, I run a pfSense APU. > > TPG doesn't have any bandwidth constraints specifically. They run a lot of > their own infrastructure including their own undersea PPC-1 cable > https://www.tpg.com.au/about/networks.php. No connection is ever shaped by > TPG and I have unlimited bandwidth. > > Amsterdam - http://www.speedtest.net/my-result/3825961515 > LA - http://www.speedtest.net/my-result/3825963543 > Boston - http://www.speedtest.net/my-result/3825964878 > London - http://www.speedtest.net/my-result/3825966771 > > So you think it isn't detecting all of my available bandwidth due to > distance and location and such? Is it just one of those things? > > torrc http://pastebin.com/GcTswhQx Actually, I think it's a matter of waiting on a stable IP and network connection for a month or two. (Your torrc looks fine.) I was just trying to list all possible factors, however unlikely. The instability is likely due to the bandwidth authorities (there's only a small number, which doesn't help stability). It will stabilise over time. But I don't think your overall level is caused by the authorities. Now that I think about it, as far as I recall, the "observed bandwidth" is a notional figure, not an actual bandwidth measurement. Because middle relays are in oversupply, their bandwidths get weighted down. (My middle relays are listed at about 50% of their advertised/link bandwidth.) Australian middle relays that are getting similar results to yours are: Aquinas DC5E2202E0148A53379F68A04207E04FFA7B4B2D (default) - Windows 8 terranullius - Windows 8 CoD Australian middle relays that are getting almost their exact advertised bandwidth: Serversaurus If you can pick the difference, I'm sure we'd be glad to know why! teor pgp 0xABFED1AC hkp://pgp.mit.edu/ https://gist.github.com/teor2345/d033b8ce0a99adbc89c5 http://0bin.net/paste/Mu92kPyphK0bqmbA#Zvt3gzMrSCAwDN6GKsUk7Q8G-eG+Y+BLpe7w…

1 0

Re: [tor-relays] Slow relay speeds for Australian geographic location(s)
by Mathew 12 Oct '14

12 Oct '14

Sorry about that test. Thanks for the in depth post, Teor. I had read the lifecycle article but was concerned when people were posting that their relay was soaking all their bandwidth after a day or two. This makes sense now, given the oversupply and location. It was also worrying when the advertised bandwidth was fluctuating so much and was only advertising a fraction of what actually is available. The Windows server is using very minimal resources at the moment, and TCP connections are around 250. The router will definitely be able to handle the load, I run a pfSense APU. TPG doesn't have any bandwidth constraints specifically. They run a lot of their own infrastructure including their own undersea PPC-1 cable https://www.tpg.com.au/about/networks.php. No connection is ever shaped by TPG and I have unlimited bandwidth. Amsterdam - http://www.speedtest.net/my-result/3825961515 LA - http://www.speedtest.net/my-result/3825963543 Boston - http://www.speedtest.net/my-result/3825964878 London - http://www.speedtest.net/my-result/3825966771 So you think it isn't detecting all of my available bandwidth due to distance and location and such? Is it just one of those things? torrc http://pastebin.com/GcTswhQx Thanks again.

1 0

Re: [tor-relays] Slow relay speeds for Australian geographic location(s)
by Mathew 12 Oct '14

12 Oct '14

Test

1 0