- tor-relays - lists.torproject.org

Re: [tor-relays] One IPv4 address, 1Gbit connection
by Tim 01 Jul '14

01 Jul '14

Tom, Why not run multiple tor relays on different ports on the same IPv4 address? For example, you could run 6 relays on 6 different ports on your IPv4 address (6 x 180 Mpbs > 1 Gbps). This would also utilise your 4 cores much more efficiently than running 2 relays (each relay will only ever use 1 core for most operations). Tim > Mon, 30 Jun 2014 14:48:59 +0200 Christian Dietrich <christian.d.dietrich(a)gmail.com>: > > Hi there, > > You will never be able to utilize the whole gigabit connection, at least > with the current tor version. > I'm also running 2 tor nodes (00000000000myTOR) on a single machine (3rd > gen Core i, Quad Core /w AES-NI) on an single IP, > reaching ~1.3 Gbit/s on an 1000 Base-T FD connection. Since you do not use > hardware accelerated crypto, > your transfer speed should be much lower. Anway my relays are also cpu > limited due to the fact that tor isn't > really utilizing much more than one cpu core. > > - Christian > > > 2014-06-30 13:05 GMT+02:00 Tom van der Woerdt <info(a)tvdw.eu>: > >> Hi, >> >> I'm running a Tor exit node on a 1gbit connection. Currently it's maxing >> at about 180Mbit/s (both ways, so 360Mbit/s) per instance, and I'm running >> two instances. >> >> That's not really using the connection well. The box has 4 cores (no >> AES-NI) and I'm looking for ways to utilize the other 640Mbit/s. >> >> Sadly it's not possible to get more IPv4 addresses on this box. I do >> however have access to a big range of IPv6 addresses. >> >> Can I somehow run more Tor instances on this box by utilizing those IPv6 >> addresses? Or are there other ways to optimize the throughput and get >> closer to that 1Gbit? >> >> Tom

3 3

New Tor node operator hibernation question
by pandemicrelay＠hushmail.com 01 Jul '14

01 Jul '14

Hello, I am a new Tor relay operator, and have setup my first relay. It's been running as a Tor middle relay for about 10 days now, and it's been running solid. It has the stable, guard, fast, running, and valid flags. I have my AccountingMax quota set to start at the first of each month at midnight. However, just past midnight on 07-01 Tor said it was going to hibernate until 07-05. This had me confused as I was only about half way through my monthly quota setup in AccountingMax for June, and my hosting provider reset the data on the first at midnight. I read the manual page about AccountingMax again, and it appears this may have been normal behavior. However before I read the manual page, I forced my relay to wake up out of that hibernation. It appears to be operating normally right now. However, I am wondering if this will cause any issues this month, or in future months? Also, can someone explain if the hibernation of 5 days was normal behavior to begin with. Thank you

1 0

Hits against GFC hex-string fingerprint in IPTables yesterday
by tor＠t-3.net 30 Jun '14

30 Jun '14

Wanted to point out to the list that we got 3 hits to our "Libero2" relay on port 9001 from chinese IP address 210.72.9.44 to a "GFC" reject line in the relay's iptables. I think this is the first time we've seen hits to this type of rule. The packets were dropped via this iptables detection: -A INPUT -p tcp -m string --hex-string "|00002800390038008800870035008400160013000a00330032009a009900450044002f00960041000500ff020100000400230000|" --algo kmp The packets came through at approximately these times EST: Jun 29 15:36:10 Jun 29 15:36:38 Jun 29 15:37:15

1 0

One IPv4 address, 1Gbit connection
by Tom van der Woerdt 30 Jun '14

30 Jun '14

Hi, I'm running a Tor exit node on a 1gbit connection. Currently it's maxing at about 180Mbit/s (both ways, so 360Mbit/s) per instance, and I'm running two instances. That's not really using the connection well. The box has 4 cores (no AES-NI) and I'm looking for ways to utilize the other 640Mbit/s. Sadly it's not possible to get more IPv4 addresses on this box. I do however have access to a big range of IPv6 addresses. Can I somehow run more Tor instances on this box by utilizing those IPv6 addresses? Or are there other ways to optimize the throughput and get closer to that 1Gbit? Tom

2 1

Spam
by kingqueen 29 Jun '14

29 Jun '14

hi, well having run a relay for just under 2 weeks, I've got my first spam on this email address. As you will no doubt have guessed, this is not my usual email address, it is only used for the Tor relay contact details, this email list and a very few other projects that will not have published my email address anywhere. So I guess that this spam is as a result of my email address appearing on Atlas or Globe or similar as a result of it being the contact address for my Tor relay. I know this possibility is mentioned in the Tor documentation; I read it somewhere. I guess there's not much to be done about it; I wouldn't want to remove contact details - the address is already in the public domain anyway, and I want to be contactable with any problems. I guess I just have to use the standard spam filtering and combating measures. Could those with experience of running a relay for longer, please advise if this will become a major problem? Will spam increase substantially? Also, any suggestions very gratefully received. Thank you! KQ --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

8 13

Circuit purposes
by Joel Cretan 29 Jun '14

29 Jun '14

I'm running a relay that I do not intend to use for anything else, so I set SocksPort to 0. I usually have two or three circuits established anyway, though, so I guess I haven't managed to disable creating those. I'm not sure what they are for. They are always labeled "Purpose: Ags=is_internal,need_capacity,". Several of them seem to get created around the same time, stay open for a while, and then get closed around the same time. I see some other circuit purposes documented here: https://stem.torproject.org/api/control.html But that documentation indicates that "Tor may provide purposes not in this enum", which is the case here. What are these circuits for, and do I need them? Here's my torrc: http://pastebin.com/fuQv8B2m Here's my ifconfig output: http://pastebin.com/mxMkhbMj I'm running tor 0.2.4.22 compiled from source (did not specify any options on make) on raspbian wheezy June 2014 with kernel version 3.12.20+. Thanks, Joel

2 3

Directory Server and bandwidth accounting
by Kali Tor 28 Jun '14

28 Jun '14

Hi, Is my understanding correct that if I set AccountingMax, the relay will never be used as a DR? It kind of feels odd because in my situation I can donate 500GB (and maybe even more) but I do want to keep a max limit and at the same time let the relay be a DR as well. Any way to achieve this? -kali-

4 5

BBC iPlayer blocked for UK middle relay operators?
by Chris Whittleston 28 Jun '14

28 Jun '14

Is anyone else running a relay in the UK having issues accessing BBC iPlayer from the same connection? For the last 6 weeks or so now I've been getting messages telling me I'm 'outside the UK' when I'm in London, and my IP address clearly resolves to show that. Just wondering if the provider BBC use for iPlayer might have started just blocking all Tor IPs recently - including middle relays. Chris

3 6

Bridge still advertising removed pluggable transport?
by Rick Huebner 28 Jun '14

28 Jun '14

Hi. I removed the recently-deprecated obfs2 transport from my (0.2.4.22) bridge's torrc, but after restarting, it seems to still be advertising support for it. It correctly doesn't appear as a "Registered server transport obfs2" line in the tor log file, and it's not listed in the TOR_PT_SERVER_TRANSPORTS or TOR_PT_SERVER_BINDADDR env vars fed to obfsproxy, nor is obfsproxy listening at the port that was formerly used for obfs2 any more. But... it's still listed in a "TransportProxy obfs2" line in the tor state file after several hours, and is still showing up as a supported transport in my bridge's details page on globe.torproject.org. It seems like that would mean it's still being handed out as a working bridge by BridgeDB for those requesting obfs2 bridges, though that port and transport will never be up again. And it might trigger mistaken "bridge is down" or "destination is censored" signals from those attempting to monitor such things. Is there something else I need to do besides dropping obfs2 from the torrc ServerTransportPlugin line, or is this just a bug? If so, it'll be showing up a lot more as obfs2 is phased out. Thanks.

2 1

Bridge clients don't *really* update dynamic bridge IPs from fingerprints?
by Rick Huebner 28 Jun '14

28 Jun '14

I run a bridge from a "semi-static" home internet account, where the address is dynamically assigned but only changes when either the ISP or my hardware router goes down and forces a reconnect, which only happens maybe once every several months. I've read in a few places that Tor bridges with dynamic IP addresses are just as useful as those with static addresses, even if their address changes pretty often, because the bridge user's client will use the bridge's fingerprint to look up its current address and port from the bridge authority if it fails to connect. How certain are we that this is actually happening? It's not the behavior I'm seeing here. My IP address has changed maybe 3 times in the last year, once for an ISP outage after a storm, and for a couple of hardware router firmware updates on my end. In each case, my bridge's traffic plummeted back to essentially nil, with a long slow regrowth over several weeks (or months!) as the new address slowly propagated around to a new set of users. I like to monitor the "Who has used my bridge?" status from Vidalia, and I get a real heartwarming glow when I see places like Syria and Iran showing up regularly. I've had a nice steady clientele keeping my bridge pretty busy for the past few months, and then yesterday I needed to do a firmware update, and *pfft* all my clients are gone again and I'm back to square one. Sigh. What's worse, I then picture that hypothetical Syrian civil rights dissident who's come to rely on my bridge always being there, suddenly being stranded without a connection and needing to scramble to find another one. Unnecessarily, as I was back up in minutes, just with a new address. It's pretty clear that the mechanism for clients to refresh their bridge's addresses is there, but I'm doubting that it's actually working right. I can think of two main failure modes: either the fingerprint isn't being distributed (or entered), leaving the user with just the current IP address and port with no way to query the bridge authority for an update. Or it's being entered, but not actually used by the client. For the first, BridgeDB does distribute the fingerprints, but I note that the docs/bridges.html.en page mentions that it's optional, but then doesn't say anything about what it's good for or why you should include it, so I wonder if many users just don't bother, especially if they need to query BridgeDB from a different PC than they run their own copy of TBB on and can't easily copy & paste the whole thing. Also, it seems the email responder channel doesn't even give out the fingerprints at all, leaving all those users automatically without updates. I don't know the distribution split between BridgeDB site queries and email queries, so it's hard to guess the impact of that lack, but it seems like something that could be easily fixed regardless. Probably more critical though, is the second option. Why would the fingerprint not be used if it was entered? Maybe some key option got disabled somehow? If I'm reading the torrc manual right, there's an option called UpdateBridgesFromAuthority that controls exactly this behavior... and it defaults to off. And to see how it ends up being set in the actual TBB, I installed that and checked its torrc, and it's not in there either, so apparently it stays disabled. "Well, there's your problem..." So am I missing something, or has this feature somehow fallen through the cracks and ended up accidentally disabled for the vast majority of all bridge users? It seems like this must be having a pretty serious impact on overall bridge usage, as I was under the impression that a big percentage of bridges are run off of dynamic address accounts, and many of those will be changing addresses more often than mine, maybe as frequently as daily in the worst cases. And every time they do, they lose their entire clientele and have to restart the long, slow ramp up to a new user base again from scratch. This kind of forced, pointless churn can't possibly be good for the network. How many bridge operators are we losing every year because they never see significant traffic due to changing IP addresses too often? And if they ask about it, they're just told, "Sure, dynamic IP is fine, just be patient and they will come." And what's the impact on the bridge users of having their bridge connections going bad so much more often than they should? I think simply getting a bridge address might be a risk exposure for many of these people, and making them do it more often could be dangerous for them. Or maybe I'm just totally misreading this, and my own experiences of losing all my bridge clients on each change aren't typical, but are due to some other unknown singular issue. How about you other bridge providers, how many of you are on dynamic IP addresses, and have you noticed a similar huge drop in traffic after a change, or does your traffic seem to snap back pretty quickly as it should?

3 3

running Tor relay live with AddressSanitizer
by starlight.2013q4＠binnacle.cx 28 Jun '14

28 Jun '14

Has anyone tried running a live relay with an image built using GCC 4.8 and -fsanitize=address? AddressSanitizer documentation says it should be no worse than about x4 on CPU and typically about x2, so it looks reasonable to try. I'm seeing peak CPU of about 7-8% of a 2.2GHz AMD core. I'd probably create a static build, with 'libevent' and 'tor' compiled using -fsanitize=address -O1 -fno-omit-frame-pointer -g per the Google documentation and 'libz' compiled normally since 'zlib' is stable and mature. Any thoughts or experience? Thanks

3 6

bitcoin adopt a node idea
by jason＠icetor.is 27 Jun '14

27 Jun '14

This seems pretty damn similiar to something we should be offering for Tor relays, possibly even exits and bridges (if they only run for a month at a time). Possibly co-ordinated through the EFF? http://www.coindesk.com/adopt-node-project-aims-bolster-bitcoin-network-sec… -Jason

6 8

Is my tor exit relay set up correctly?
by Sander Bongers 26 Jun '14

26 Jun '14

Hi, A few weeks ago I setup a tor exit relay, using this documentation: https://www.torproject.org/docs/tor-relay-debian.html.en I have somewhat experience, so I kinda knew what I was doing, and I got the message "Self-testing indicates your ORPort is reachable from the outside. Excellent." in the log file. But my server doesn't seem to appear in any tor relay lists such as https://globe.torproject.org, even after a few weeks. What could I have done wrong?

4 5

Re: [tor-relays] [tor-relay] Spam
by tor＠t-3.net 26 Jun '14

26 Jun '14

The spam to my own Tor relay operator email address (same one as in this list) isn't meaningful in volume. I haven't seen any amounts that a delete key couldn't easily handle. In my experience, you should be careful with spam filtering, as you could end up dumping abuse complaints that you wanted to see and maybe respond to, or have legitimate relay list email not come through. I ended up having to whitelist some stuff for this list to work right because of automatic spam behavior of this mail service. It's not like the sight of spam email in your tor relay box is toxic to your workstation. It's usually obvious from the subject what it is, and that it can be safely and immediately deleted.

2 1

Need help to get TorDNSEL compiled
by BlueStar88 26 Jun '14

26 Jun '14

Hi there, today I've read about the outage at "check.torproject.org". Since my torcheck-service "torcheck.xenobite.eu" needs the underlying TorDNSEL feature I'm trying to get this to work on my host. Like this I won't need to query the TorDNSEL-part of "check.torproject.org" anymore. I'm not into programming and do not know anything about haskell, c++ and such. So be patient with me on such matters. ;-) I've DL'ed the code from the internet website mirror [2]. I've prepp'ed all the dependencies using lucid binary packages: ghc6 6.12.1-12 libghc6-mtl-dev 1.1.0.2-10 libghc6-network-dev 2.2.1.7-1 libghc6-time-dev 1.1.2.4-2 libghc6-hunit-dev 1.2.2.1-2 libssl-dev 0.9.8k-7ubuntu8.15 libghc6-stm-prof 2.1.1.2-5 libghc6-binary-prof 0.5.0.2-1 First error I got on compile attempt was: src/TorDNSEL/Main.hs:81:21: parse error on input `#' That was quite easy thought: import GHC.Prim (Addr#) I deleted the '#' hopefully making it correct this way. Next error is some numbers too high for me now: src/TorDNSEL/DeepSeq.hs:20:7: Could not find module `Data.ByteString': It is a member of the hidden package `bytestring-0.9.1.5'. Perhaps you need to add `bytestring' to the build-depends in your .cabal file. Use -v to see a list of the files searched for. The libghc6-bytestring-dev-0.9.1.5-125af ist installed by it's main package ghc6 6.12.1-12. Any ideas? Or are there some binary packages for TorDNSEL around, to make this more easy for me? :-P Thanks, BlueStar88 [1] https://blog.torproject.org/blog/tor-check-outage-03-and-04-july-2013 [2] https://www.torproject.org/tordnsel/dist/tordnsel-0.0.6.tar.gz

3 7

My exit's traffic isn't rising, is this normal?
by Jesse Victors 24 Jun '14

24 Jun '14

Hello everyone, I run https://globe.torproject.org/#/relay/1946F5E4748B069D3B989B5AF50C7DDD3AC618… and from the graphs it's clear that the traffic has roughly leveled off, rather than continue to climb. I generated a new key after Heartbleed, so it's been up for nearly three months. The bandwidth cap is set at about 100 MB/sec, (gigabit connection) which it's not even close to reaching. There's plenty of CPU available, and by all rights its got enough resources. At this rate, I've no idea how it is supposed to grow and help Tor more. For comparison, when I look at https://globe.torproject.org/#/relay/D3BDECB920E0B7543AD2BA7BF573F7B0F37F7B…, one of the Top 10 relays, I see the traffic growing much at a much higher rate, and https://globe.torproject.org/#/relay/F3B57BB429B4CA82A844B713E42666DF4BF7B8… is another example. What are they doing that I'm not? Another of my exits, https://globe.torproject.org/#/relay/2FC06226AE152FBAB7620BB107CDEF0E70876A…, is on a downward trend, yet has the same configuration as my first one. What can I do to reverse it? Thanks, Jesse V. 0xC20BEC80

1 0

KVM based virtual machine showing 4 MB/s in atlas, others showing 8-9MB/s ?
by s7r＠sky-ip.org 23 Jun '14

23 Jun '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, The same virtualization technique at different providers gives me different advertised bandwidth for relays in atlas: one provider 8-9MB/s other 3-4 MB/s The relays are all exit, having the same RAM and CPU configuration, as well as 100mbit port and unmetered traffic, they use the same Tor version, none of them are capped in any way via torrc or other means, same operating system and same virtualization technique. Why could be this difference in advertised bandwidth? Suggestions? - -- s7r PGP Fingerprint: 7C36 9232 5ABD FB0B 3021 03F1 837F A52C 8126 5B11 PGP Pubkey: http://www.sky-ip.org/s7r@sky-ip.org.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.17 (MingW32) iQEcBAEBAgAGBQJTqIMAAAoJEIN/pSyBJlsRTg0IAKGweB8grMmx18rB33/xBrBC 6UAbpnUxj3tDlD+7J9SwK1jkPSvxpKEkKuwblFifJ2J1o4xoUKCvQQWLVfwP4qRI 0R6cn/Zx9pShzZ6MRRIOmuxaZjiavddqeM0/qcnwhsvGVH/6sTw80000VrLV2TMH vExzu7ofEjV1205CZ1CBAj0sOW2s+3nld7iulvttWbBoeHs2+CbRpEfQu1QPoZYu NtJ6f0vBBkenCWD/yv9Xaiwo/Ywej6jH97LIdksr9msRcDmJnbmY3VSmrlnm8n7z YFJSCFlOi3LJIB0y8QmZuowHAQcGe0Q1LmGCWU4uGgB4OHU7QRgC/jM7qffp+eQ= =+FWS -----END PGP SIGNATURE-----

1 0

Shutting down middle relays (off-topic)
by Tora Tora Tora 23 Jun '14

23 Jun '14

Regretfully, I have to shutdown my two middle relays (not too big, you won't even notice it :-D), since I am unable to resolve issues with the latest OpenSSL bug. I was able to find upgraded packages for Centos and Fedora that are supposed to address CVE-2014-0224 vulnerability (the change log claims so). However, the Tripwire )SSL_CCS_InjectTest and Qualys onlien tests both disagree. If someone can suggest a resolution that works, I might be able to keep them running, otherwise I see no point in running vulnerable relays until I figure things out. Thanks ...

7 15

CLI tool like Atlast
by Kali Tor 23 Jun '14

23 Jun '14

Hi all, Is there a CLI client/tool that does what https://atlas.torproject.org/ does? Basically provide an output based on a node's fingerprint? e.g. https://atlas.torproject.org/#details/7EDE11A41D1C7DF4F9103ABAA4F0A31E42CB0… Thanks, KaliTor

5 14

Lost hsdir flag
by kingqueen 21 Jun '14

21 Jun '14

hello, I don't know why, my relay nicknamed kingqueenbtnftw used to have the hsdir flag but now doesn't. I think from what I can gather, hsdir is based purely on the time since last boot / restart Tor service, rather than how long the relay has been up in total? That would explain it. Thanks kingqueen --- This email is free from viruses and malware because avast! Antivirus protection is active. http://www.avast.com

2 2

Traffic limitation
by johhher 20 Jun '14

20 Jun '14

Hi, I'm running a Tor relay on a cheap Linux vserver with high bandwidth. I have a traffic limitation of 500Gb per month and was just wondering what would be the best configuration for the network. Currently I've limited the traffic to a daily maximum to prevent it from hibernating a long time at the end of the month. Is this the right way to do it? Or would be better to limit it on a monthly basis. Thanks for an answer! Johhher

6 5

Yahoo and AOL emails removed from tor-relays due to bounces
by Andrew Lewman 20 Jun '14

20 Jun '14

It seems Yahoo and AOL email servers have decided to refuse all messages from this tor-relays list. Other lists aren't affected, yet. We're seeing this message from Yahoo and AOL servers: "Status: 5.2.1 Remote-MTA: dns; mailin-04.mx.aol.com Diagnostic-Code: smtp; 521 5.2.1 : (DMARC) This message failed DMARC Evaluation and is being refused due to provided DMARC Policy" There is no fix for this yet as it breaks mailing list software globally. This bug explains the situation, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752084 If you use yahoo or aol for email, unfortunately you can't join nor receive email from our lists. I suspect this will become true for all of our email lists soon. -- Andrew pgp 0x6B4D6475 https://www.torproject.org/ +1-781-948-1982

3 2

CentOS of the air
by I 19 Jun '14

19 Jun '14

"At about 02:00 UTC June 18th 2014, changes at the domain registrar caused the CentOS.org domain to get marked as Inactive. This caused widespread outages, with all services in centos.org including: - - Mirror Network ( internal centos.org as well as external ) - - All mirrorlist - - All isolist - - Website ( including bugs.centos.org and wiki.centos.org - - All internal support infrastructure Services were restored at the registrar just before 9:00 AM UTC June 18th, however depending on dns path some users might still see issues for upto 6 to 8 hrs from that point.

1 0

tor-arm question
by Adam Griffin 19 Jun '14

19 Jun '14

Hi, Just started a new tor relay on my raspberry pi yesterday and I'm monitoring with tor-arm over ssh. I'm currently listed on atlas.torproject.org with flags 'Fast', 'Running', 'V2Dir', and 'Valid' with > 17hrs uptime. However, tor-arm is showing a blank for uptime and about once a minute, the CLI goes blank and then flickers back. (the flickering happens at the same rate for local and remote SSH) Also, about once every couple hours I get a 'Relay unresponsive' and then 10 seconds later 'Relay resumed'. Anything to do to remedy these issues?

3 5

Help keeping Tor relay up
by Evelyne Fong 19 Jun '14

19 Jun '14

I've managed to get my relay running long enough to run the bandwidth check and have it succeed. I'll check Atlus and it'll say my relay's up and running. However when I check again about an hour later, it's saying that "Running: false". I've set up the relay recently, so I'm not expecting a lot of traffic. However, I'm confused as to if my relay is suddenly failing for no reason or is Atlus saying my relay is no longer running because there's no traffic on it. Any help would be appreciated. Thanks.

3 3