- tor-relays - lists.torproject.org

DDOS?
by mick 31 Dec '12

31 Dec '12

Hi guys The provider for one of my VPSs, running my tor node tor.baldric.net has shut it down (unilaterally and without telling me) a couple of times this month, most recently today. Their response to my query as to why is that they say they are seeing a large DDOS attack on the VPS server hosting my node, apparently aimed at my address. I shut tor down while I investigated and when running nethogs I noticed a shed load of attempted connections to my tor port (443) from non-tor addresses. A snapshot is at http://rlogin.net/tor/incoming.png Anyone else seeing anything similar? I can't believe I'm the only node being poked. Cheers Mick --------------------------------------------------------------------- blog: baldric.net gpg fingerprint: FC23 3338 F664 5E66 876B 72C0 0A1F E60B 5BAD D312 ---------------------------------------------------------------------

6 10

Complaint about spam originating from my server
by Brock Tice 14 Dec '12

14 Dec '12

Hello all, I follow the guide for avoiding abuse notices, and generally I only get 1/year of the DMCA variety. However, I recently received this complaint, which appears to show spam originating from my Tor server (209.188.113.101 / tor-proxy.anfani.com) As far as I know, port 25 is blocked on my exit policy. Port 587 is allowed. I do have a mail server running on this machine, but it does not accept outside connections. Is there something I am missing? Is there anything else I should do to prevent this in the future? Could there be some way that a Tor user could locally send mail using my server? Thanks, --Brock -------- Original Message -------- Subject: RES: Fwd: Olá Date: Thu, 13 Dec 2012 14:41:22 +0000 (UTC) From: abuse(a)terra.com.br To: Luis Barzon <barzon(a)terra.com.br> CC: network-abuse(a)cc.yahoo-inc.com, brock(a)anfani.com Prezado Usuário, O Departamento de Abuse do Terra trabalha seriamente para proteger seus assinantes contra abusos cometidos por terceiros. Nosso objetivo é proporcionar segurança aos nossos Clientes, evitando e impedindo o mau uso da Internet, através dos servidores Terra. Em relação a sua reclamação, informamos que após análise, identificamos que o responsável não pertence ao Terra.Nesses casos identificamos o administrador e encaminhamos a incidência para a devida tratativa. Salientamos que as devidas ações corretivas passam a ser de responsabilidade do administrador da rede identificada. Para o seu conhecimento, o endereço de contato que encaminhamos a incidência é: network-abuse(a)cc.yahoo-inc.com <mailto:network-abuse@cc.yahoo-inc.com>, brock(a)anfani.com <mailto:brock@anfani.com> Atenciosamente, Rafael Doyle Equipe de Segurança Terra - Depto. de Abuse abuse(a)terra.com.br <mailto:abuse@terra.com.br> SAN - Servico de Atendimento Nacional Fax: (51) 3287-9087 ------------ Mensagem Original ------------ *De:* Luis Barzon [barzon@terra.com.br];abuse@terra.com.br *Enviada em:* 11/12/2012 15:15:49 *Para:* abuse(a)terra.com.br *Assunto:* Fwd: Olá =?iso-8859-1?Q? Return-Path:_<web02689(a)att.net> received:_from_[10.235.200.103]_by_preston.tpn.terra.com_(LMTP);_Tue,_11_Dec_2012_12:26:19_+0000_(UTC) received:_from_if00-mail-sr03-mia.mta.terra.com_(if00-mail-sr03-mia.mta.terra.com_[208.84.243.10])_by_1n7.tpn.terra.com_(Postfix)_with_ESMTP_id_C790122CC_for_<barzon(a)terra.com.br>;_Tue,_11_Dec_2012_12:26:18_+0000_(UTC) received:_from_ochaua.tpn.terra.com_(unknown_[10.235.200.126])_by_mail-sr03-mia.tpn.terra.com_(Postfix)_with_ESMTP_id_190696002271_for_<barzon(a)terra.com.br>;_Tue,_11_Dec_2012_12:26:16_+0000_(UTC) received:_by_ochaua.tpn.terra.com_(Postfix,_from_userid_520)_id_17A1D229EFAAC;_Tue,_11_Dec_2012_12:26:16_+0000_(UTC) received:_from_[10.235.200.97]_by_ochaua.tpn.terra.com_(LMTP);_Tue,_11_Dec_2012_12:26:15_+0000_(UTC) received:_from_nm17-vm0.bullet.mail.gq1.yahoo.com_(nm17-vm0.bullet.mail.gq1.yahoo.com_[98.137.177.224])_by_1j4.tpn.terra.com_(Postfix)_with_ESMTP_id_5A96DC0000DFA_for_<waleria.luis(a)itelefonica.com.br>;_Tue,_11_Dec_2012_12:25:02_+0000_(UTC) received:_from_[98.137.12.55]_by_nm17.bullet.mail.gq1.yahoo.com_with_NNFMP;_11_Dec_2012_11:54:56_-0000 received:_from_[98.139.44.79]_by_tm15.bullet.mail.gq1.yahoo.com_with_NNFMP;_11_Dec_2012_11:54:56_-0000 received:_from_[127.0.0.1]_by_omp1016.access.mail.sp2.yahoo.com_with_NNFMP;_11_Dec_2012_11:54:56_-0000 received:_(qmail_60874_invoked_by_uid_60001);_11_Dec_2012_11:54:56_-0000 received:_from_[209.188.113.101]_by_web184904.mail.gq1.yahoo.com_via_HTTP;_Tue,_11_Dec_2012_03:54:56_PST X-Terra-Karma:_0% X-Terra-Hash:_5d0acc65d08e1a21e9e416133fc07644 X-Terra-Delivered-To:_6972688#perm!vivodiscbrlm X-Yahoo-Newman-Property:_ymail-3 X-Yahoo-Newman-Id:_716919.82230.bm@omp1016.access.mail.sp2.yahoo.com Dkim-Signature:_v=1;_a=rsa-sha256;_c=relaxed/relaxed;_d=att.net;_s=s1024;_t=1355226896;_bh=7Ocy5nwKIISVUmGV43vB0i1iNVN39I1mHkdz3VPVAFE=;_h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;_b=0eDgFzVzb+Is8oPpjwC7X7ykXEwP1vqK/KsMDuq6G031UGtMUoUEWjrbWvkP/tKStZS97RKSOYJIE1qQgMEGI20mvh9kdbTAlmoPjGwqaBIEYLmL9f7/Q1XCDiJm5cfPhFd/h5gn0ZUnCySIrkWtz2lBu8MGN1PMKASROPpG+40= Domainkey-Signature:_a=rsa-sha1;_q=dns;_c=nofws;__s=s1024;_d=att.net;__h=X-YMail-OSG:Received:X-Rocket-MIMEInfo:X-Mailer:Message-ID:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;__b=k3zX4zTRmj4a+jDcq+hmrP16lkRdtgX/yE2X3sueOVGLvbhnzLcVv/BL36y5nKhGPVCRhAqLpgCTJcxtYlcPXwqGSioqqso+tTm2D3Erses151z2aE3O0Zh6h9rVPUC4dqpOa5hObz9Xk8JqvvhsL6iUEQ845+OhFclyx3dSvSE=; X-Ymail-Osg:_bt8QfNYVM1k4GHRsx7y5pfUGNSY6POK5unpLV_C31c4vkp__wiUd09OX7vaDxaaiyySoyCgUEVGfXdTTl80vwJw6IPtOfHpuS0EG_l86Hxyx_vym.CY7gciAimFEEoWBpvWo7QWAwqsVQPv7soRtipZBxkFXCCX2PtUGsQrkI_XAOwfJggidaSr3gtWqG3UTWBq2ncBnZOKX2UrowDDWI_fxuExXmq34owVBCQ_iAnR3RdyhAULqzrDic5WJdJtZFxmDUM9x957AYKvCX7XZZU99Zo5w0w.QdCL_H.XFp1W_mqhW07Y_zSDOZovHJZoWZliXJFc3LZPbeRWhRjCPlm3UrJYKyY3m_s0LvztqJP_kN.xenaemuhGfD0tZLKwGJXKRWDTc7CkJ6MOscOeS.ByYdUxJG_LI4aoTrmi2UJfQ.bcOzn7eU5h3bzIx9qUJ5adHil_8M3SI5wE8LpDdkSZPJQ_7z7D_yRyQap1qel8fK_4sKScaeTDKEsSH31ZEBWQYwcmzZMvMOvxVETA.2RX_5fbK8QLeCADZ5cLQxBHhObi1.IYT0FMM37nUNfrZg1V2Tt0lWUn3kh8pP7jh_QCmg1y7vH0WwDGdDeKWhI07pf8z8e1NlEJ9Z1jTnISKVuHodZa5cpGOPssPG_7QePJvqaBTDLrc3uewNOvnj_e53jnQPEKCexdGBa5K.hMwmCJ79Otno5GXtp_Faro- X-Rocket-Mimeinfo:_001.001,DQoNCk9sw6ENCgpCb20gdGUgY29uaGVjZXIsIEV1IHNvdSBNaXNzIEZsb3VyZW5jZSwgZXUgZ29zdGFyaWEgZGUgdMOqLWxvIGNvbW8gbWV1IGFtaWdvLCBwb3IgZmF2b3IsIHZvY8OqIHBvZGVyaWEgdm9sdGFyIHBhcmEgbWltIHBhcmEgbWFpcyBkZXRhbGhlcyBkbyBtZXUgZXUsIGUgdG9kb3MgdGFsdmV6IG5lY2Vzc8OhcmlvIGVtIHJlbGHDp8OjbyBpbmNsdXNpdmUgYSBtaW5oYSBpbWFnZW0sIHNlIGVzdGUgaW50ZXJlc3NlIHF1ZSB2b2PDqiB2b2x0YXIgcGFyYSBtaW0gLiBzZXUgRmxvdXJlbmNlLg0KCi4BMAEBAQE- X-Mailer:_YahooMailClassic/15.1.1_YahooMailWebService/0.8.128.478 Message-Id:_<1355226896.58713.YahooMailClassic(a)web184904.mail.gq1.yahoo.com> Date:_Tue,_11_Dec_2012_03:54:56_-0800_(PST) From:_Fl_Dosi_<web02689(a)att.net> Reply-To:_flourencedosi@yahoo.co.uk Subject:_?= Olá To:_undisclosed_recipients:_; X-Clx-Rate-Response:_fh=1j4;_fi=10.235.200.250:2001;_rg=B;_GT=-934589197;_fs=45;_ns=164;_id=BFBwyXX6-BB122532k;_rv=7182/208.84.242.250:14051;_ts=H/Mq6;_gv=-25;_fp=IC46g;_gd=1;_fl=IAA;_ip=98.137.177.224;_he=NiDDbon0Jbq;_ht=1;_nt=0;_ho=Drk85SdDLJY;_hd=EmCVu0/pq3k;_hf=KuHCD1QD89G;_hF=EeGv2Nz5zhR;_hj=GOnAt8y/c4h;_hr=EiVSUfo4L9J;_ZM=KIpT9Tbxt6G;_ZB=GSe9x8zMeYG;_ZB=IKbBeAtS5zj;_ZB=Ei/hJgabWx3;_ZB=GJeEnTMQT26;_ZB=Mru7Qx7UNOT;_ZF=C5pWnNZauWE;_Zi=GVxvNHWVzGA; X-Clx-Id:_a113GLF9X16I0VH-BB122538 X-Abaca-Is-Spam:_false X-Abaca-Spam:_45 X-Terra-Client-Ip:_98.137.177.224 X-Milter-Version:_master.39-g1fd3ecd+ Content-Type:_multipart/alternative;_boundary="514226816-1910405447-1355226896=:58713" X-Terra-Spam:_No X-Terra-Rec-Key:_YmFyem9uQHRlcnJhLmNvbS5icg== Mime-Version:_1.0 * -----_Original_Message_----- From:_Fl_Dosi_web02689@att.net To:_undisclosed_recipients:_; Cc:_ Sent:_Ter_11/12/12_08:54 Subject:_Fwd:_Olá * Olá Bom_te_conhecer,_Eu_sou_Miss_Flourence,_eu_gostaria_de_tê-lo_como_meu_amigo,_por_favor,_você_poderia_voltar_para_mim_para_mais_detalhes_do_meu_eu,_e_todos_talvez_necessário_em_relação_inclusive_a_minha_imagem,_se_este_interesse_que_você_voltar_para_mim_._seu_Flourence. .................................................................................. Hello Nice_Meeting_You,_i_am_miss_Flourence,_i_wish_to_have_you_as_my_friend,_please_could_you_get_back_to_me_for_more_detail_of_my_self,_and_all_maybe_necessary_in_relationship_including_my_picture,_if_this_interest_you_get_back_to_me.yours_Flourence.

5 4

Hack attempts made to appear as exit node?
by Steve Snyder 06 Dec '12

06 Dec '12

I recent days I have gotten 3 complaints from people who report hack attempts from my exit node, at 82.221.99.229. One problem: this IP address is not in use by me and never has been. The RDNS for this address is "tor-exit.burratino.net" and there is the standard Tor explanatory page on http://82.221.99.229/. The "email the maintainer" is a mailto link to my e-mail address, thus the contacts from people reporting hack attempts. I guess that the page on port 80 was ripped from my actual exit although it is slightly different in that my page has my IP address on it, and http://82.221.99.229/ doesn't reference any particular IP address. Further, I can find no evidence ( https://metrics.torproject.org/exonerator.html ) that this IP address has ever actually run a Tor node. Am I crazy or is someone doing port-scanning and making it appear to be from a Tor exit node?

1 0

Traffic pattern on Tor relay
by tor-admin 05 Dec '12

05 Dec '12

Hi, I am monitoring the network interface of my tor server with nload. From time to time nload shows strange traffic patterns: http://i.imgur.com/0Wr9h.png The graph is updated every second so one hash mark corresponds to one second. The most recent traffic value is on the right side. The graph shows that the traffic oscillates with a period of about 14 seconds and the traffic doubles in the peaks. Does anyone has an explanation of this pattern? Regards, Torland

2 1

Prepared for [Raided for running a Tor exit node]?
by grarpamp 01 Dec '12

01 Dec '12

> Only regarding home Wireless access in the US > I was involved in a case with just this situation. > > According to my lawyer there is no consensus on who is responsible for wifi. > Every State has different laws each one is just a vague. > In NY, if your wireless is secured (pw protected) you are ok. > In NH, you are responsible for all data that passes your wifi point secured > or not. > In MA(my state) there is no specific law Putting links to such laws on the Tor wiki would be useful for operators and users to know. It would seem hard to believe that there are 'must secure' laws [1] in the US or elsewhere. Even harder that anyone would be sentenced... regardless of whether their AP is open, 12345, or dR;$8w@G... merely for traffic traversing their AP/node that was not theirs, or that cannot be proven was theirs. Not that you wouldn't be questioned, charged or held before the case was dropped. [1] There are 'must secure' civil ISP contracts. They are only meant to 'secure' more revenue (no account/line sharing) for the ISP and save revenue from dealing with whatever headaches your open AP/node creates. And criminal 'theft of service' laws for the same reasons. > you just need a good lawyer :) This (and links to the actual laws) are much easier to believe. Because if someone here took the NY example above literally and did illegal deeds via their secured wifi thinking that example was the law (and thus their immunity), they be jailed pretty quickly. And what does being forced to secure or responsible mean? If you hit a bug, exploit, or get cracked, and can show it, you're jailed? What if there is no proof either way but the existence of traffic, is the user then jailed by default? What if no evidence but crypted disk, or questions as to character/belief? In those crazy places even 100% lily white users would seem better off running an open AP/node and risking that lone lesser charge [2] than attempting to be rather secure, risking a crack, and being held responsible for some major crime. [2] If the major wasn't dropped, at least they'd be jailed with evidence the access was open, which looks a lot better than if it wasn't. The crazy is why you're supposed to visit, write, call and email your lawmakers, educate your executive, and hang your jury.

2 2

Suggestions for Tor Relay Operators after a Police interaction
by Andrew Lewman 30 Nov '12

30 Nov '12

# Suggestions for Tor Relay Operators after a Police interaction Disclaimer: We are not lawyers, and this is not legal advice. This is friendly advice from those of us at Tor who work with relay operators after a police visit or raid. This is a collection of suggestions of what we've gathered from five years of helping people like you. Exit relay operator visits are exceedingly rare. You are in the 1% of operators ever visited or even raided by a police force. If you're reading this message, then you probably have a poor photocopy of the warrant the police served to you. The warrant may mention Tor and some suspected criminal activity (such as terrorism, money laundering, child abuse materials, or copyright violations). 1. Read the EFF legal FAQ for relay operators, https://www.torproject.org/eff/tor-legal-faq.html.en. 2. Find legal representation. A list of possible legal advisers can be found here, https://blog.torproject.org/blog/start-tor-legal-support-directory. If none of these people are in your country, or close to you, ask either the EFF or Tor Project. We can likely help you find someone in your jurisdiction. 3. Get a copy of the full warrant. There is a generally a process to get a full copy of the warrant. It will have details you'll need to know to defend yourself. At a minimum, it's likely to have a timestamp and IP address of your exit relay. 4. Make sure the IP address in question is your exit relay and was a valid relay at the time in question. We make available the exonerator tool to look through the entire history of the Tor Network to find your relay, https://metrics.torproject.org/exonerator.html. 5. Get in touch with The Tor Project, preferably by email, see https://www.torproject.org/about/contact for finding ways to reach us. If you need someone official to explain Tor to either a bondsman, judge, or the police, generally phone works best, https://www.torproject.org/about/contact#phone. When you contact Tor, we need the following details in order to help you maintain your innocence: - The IP address of each relay. - The timestamp (date and time of day) for each IP address in the warrant. - How to reach you or your legal adviser. 6. Likely, your legal adviser is going to want a signed, notarized, official letter from the Tor Project stating the IP address was or was not an exit relay at the date and time in question. They are going to want this mailed via trackable method (FedEx, UPS, DHL, registered mail, etc). We need to know if you want one letter per IP/timestamp combination, or if we can put everything into one letter. Best of luck going forward. The police generally only receive an IP address and a street address. They do not know it is a tor exit relay. Some national police forces in Europe and North America are sophisticated enough to determine "tor or not" before they execute a warrant. Generally, but not always, these national police forces send detectives to interview you (known as a "knock and talk"), rather than send in a SWAT team (known as a raid). The press repeats the SWAT team stories because it generates page views for their organization. It's not the norm. Tor is available for further help, whether it be as an expert witness, further explanations of how Tor works, etc. Just ask for help, we're happy to do so. By sharing your experience with us, you also help us to help law enforcement understand Tor better in the future. Thanks for sharing and thanks for running a relay. -- Andrew http://tpo.is/contact pgp 0x6B4D6475

2 1

Prepared for [Raided for running a Tor exit node]?
by grarpamp 30 Nov '12

30 Nov '12

>> Running an exit node from home DSL or Cable is bad idea. One must look >> for a Tor friendly ISP and have balls made of steel! ... ISP[/hoster] and[/or] have ... > However, I do not believe it is that way in > the United States What 'way'? Running an exit node at home, or elsewhere, would seem to come down to... a) Are you physically ready for a query / subpoena / search warrant / exigent raid? Are things segregated by room? Are your doors and machines labeled with the same sort of exit node notice you'd put on the TCP port and in DNS? Have you inventoried, photographed and documented your setup and property? Do you have offsite backups? Are private things encrypted? Are any co-habitants aware and similarly prepared? b) Are you mentally ready? Is your life and butt otherwise clean, legal, and organized? If you were to appear in court, how would you act and be perceived? How do you feel about being in the news and in public docs? Have you networked with other operators and entities? c) Are you legally, financially, and timewise ready? Have you consulted with and preselected a couple attorneys? Have you made arrangements for making bail? How will you make court required appearances? All these sorts of meta things, and surely more, come into play whether or not you're ever raided. I'd suggest making a wiki article for them.

1 0

How to get client locale statistics without arm?
by tor-admin 30 Nov '12

30 Nov '12

Hi, I would like to know from which countries my nodes are mostly used. I tried to use arm for this but on high capacity relays arm eats the same cpu resources as the tor process it monitors, if the connection panel is activated. Switching to the connection panel lets arm often freeze. Is there another way to get country statistics from a node? Maybe something build in Tor? Thanks, Torland

2 3

Bandwidth and server leads [was: Tor raid]
by grarpamp 29 Nov '12

29 Nov '12

> From: elijah wright <elw(a)stderr.org> > Date: Thu, 29 Nov 2012 13:38:51 -0600 > Cc: nanog(a)nanog.org > Subject: Re: William was raided for running a Tor exit node. > We had a guy (aka potential customer) inquire the other day about hosting a > Tor exit on our infrastructure the other day; he disappeared fairly > quickly when he figured out that we weren't just going to give him an > endless supply of unmetered 10G bandwidth. I was looking forward to > billing him. :-) Contemporary mailing list lols aside, I believe you'll find that most operators in this space are quite serious and professional. If you're a potential friend of Tor, anonymity networks and the general thought space around it... and your price [or that of someone you know, nanog or otherwise, who might be such a friend] was highly competitive, or even special... I'd be fairly confident that consultation with those on this list would lead to a sale of said (or related) billable services. Feel free to forward and/or put any interested parties in touch with this list or torproject.org.

1 0

Deploy relays using hidden exit IP's?
by grarpamp 29 Nov '12

29 Nov '12

Shouldn't some exit relays (funded or not) be deployed to use an exit IP that is different from it's advertised exit IP in order to prevent a simplistic form of blocking based on scraping the descriptor set? I think this can happen if the default route is out another interface or secondary address. Something of that nature.

10 14

setting up a Tor exit node
by esolve esolve 29 Nov '12

29 Nov '12

I want to use Tor browser bundle to set up a Tor exit node in vidalia, I click "set up relay" -> sharing then there are some options, I checked "Relay traffic for the Tor network(exit relay)" and then click "ok" however, it doesn't work, and the exit relay option is automatically unchecked, while the option "relay traffic inside the tor network (non-exit relay)" is checked how can I set up a Tor exit node? thanks!

5 13

TOR relay and their flags
by androny 29 Nov '12

29 Nov '12

Hello all! My torrc main config: SocksPort 0 RunAsDaemon 1 DataDirectory /tmp/.tor ControlPort 9051 CookieAuthentication 1 ORPort 4999 AvoidDiskWrites 1 BridgeRelay 1 ExitPolicy reject *:* so, its pure relay. Run arm and got: "flags: none" Well, read flags definitions at https://gitweb.torproject.org/torspec.git?a=blob_plain;hb=HEAD;f=dir-spec.t… and still don't understand it :-) My tor has almost 4 days uptime, and at logs have: ----- Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor ----- Performing bandwidth self-test...done. ----- Tor has successfully opened a circuit. Looks like client functionality is working ----- Connections (1 inbound, 6 circuit, 1 control) ----- It means, it works well - so, why my tor relay server doesn't have an "Running" flag, "Valid" flag or "Stable"? Regards And-ron

4 3

DFRI is running two sponsored exits
by Linus Nordberg 26 Nov '12

26 Nov '12

Hi Moritz, DFRI [1] is running two relays, DFRI0 and DFRI3, which should qualify as fast relays as defined by sponsor j. (They were just recently bumped From 10 MB to 12.5 MB. They both have an exit policy allowing the ports explicitly required on https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorJ.) We'd love to be able to get some funds for this which would make it possible for us to run more exit traffic. We only have one /24 network to run exit traffic from atm though so this is all we can do for now without breaking the stated diversity rules. (Anybody sitting on an IPv4 /24 PI that we can borrow for a year or so? We'd handle it with care!) We could technically run bridges too but we would have to discuss this internally some more first. Do we really want to take money for running entry _and_ exit relays? Isn't that exactly how you'd attack Tor users if you had the power, by controlling entry and exit? If we've missed some public discussion on this topic, please point us at it. [1] https://dfri.se/index.en/ Thanks, Linus, DFRI

4 4

Setting up new Tor relay
by Lance Hathaway 25 Nov '12

25 Nov '12

Hi all, I'm trying to set up a Tor bridge relay as an NT service under Windows 2003 x64. It runs, but only when I -don't- pass it a torrc file. Specifically, I've tried the following: 1. Installed service using "tor --service install". This installed the Tor service, with files located in "C:\Documents and Settings\LocalService\tor". I copied a torrc file into this directory and edited it to correctly set the ports and other options to be a bridge relay. After placing this file into the directory, attempting to start the service results in error 1064: an exception occurred in the service when handling the control request. Renaming or removing the torrc file allows the service to start. 2. After reading some old posts to tor-talk and tor-relays, I ensured that the directory has full permissions assigned to SERVICE and LOCAL SERVICE accounts. No change. 3. I removed the service and created a new directory for the configuration and log files, located at "C:\torsvc". I installed the service again with "tor --service install -option -f "C:\torsvc\torrc". I also ensured the new directory had all permissions set correctly. The service installed as "tor -net-service" without any options and executed successfully. I stopped the service and fixed the path in the registry to include "-f "C:\torsvc\torrc"", but then the service wouldn't start any more. 4. I verified the permissions on the torsvc directory. After removing the -f option from the service, the service starts successfully again, albeit without my configs (including log locations which would tell me what was going wrong). Sorry to be a bother, but could anybody offer me some enlightenment on what I'm missing??? -Lance

2 3

(no subject)
by Znerol2 25 Nov '12

25 Nov '12

Sent from Samsung Mobile

1 0

Akamai running Tor exit relays
by tagnaq 24 Nov '12

24 Nov '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, I found out about it via Moritz's twitter feed [1] and I think it is great. Am quite curious about it. Does anyone have some insights on why Akamai decided to start 10 fast exit relays? (CC'ing the relays contact address here) Some compass stats [2]: bandwith: 2.75% of the Tor network exit probability: 6.97% [1] https://twitter.com/torservers/status/266669861139255296 [2] https://compass.torproject.org/?family=C3D1F08204E2BF81C6A426F312AE3A2212C7… -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAlCws7EACgkQyM26BSNOM7YTnQD+L6D2fH6T5QmR0MUh4wJAnan2 Aag6ImaavJeFZS+jihwA/2roYnLDlocvfgoHe4cDk7vJvGctTGgylLi/FdH2tf9r =zf1i -----END PGP SIGNATURE-----

1 0

traffic pattern indicates MITM?
by ea 19 Nov '12

19 Nov '12

For four days the BW graph and usage table of my bridge indicated noticeable traffic and then the graph dropped precipitously to near zero & the table shows no recent usage. Vidalia/tor are working fine. I did try rebooting my router-modem gateway last night, but as far as I could monitor it, the traffic has still been near zero (maybe a few KB every hour or so). If I'm reading it correctly, onionoo is showing that the bridge is still published. I'm not complaining about this pattern, but wondering if the abrupt drop-off in traffic for a still-published bridge is diagnostic of MITM activity. Maybe there's a way to further monitor my bridge from within the network? If MITM is suspected, should I shut down the bridge for a day or so?

2 1

Tor marked as "enforced" process in Apparmor, but also "unconfined"
by Christian 14 Nov '12

14 Nov '12

Dear fellows, I use Ubuntu Precise 12.04 and as I run a Bridge, I find the idea of confining Tor with an Apparmor profile charming. When upgrading Ubuntu and Tor, the Apparmor stuff seemed to be automatically worked out, so I deleted my old handmade usr.sbin.tor profile as I found the new system_tor profile. Wenn I type "sudo aa-status", I get system_tor as "enforced process" with its correct process id and there's no process "unconfined, but with a profile defined". But when I type "sudo aa-unconfined", /usr/sbin/tor ist marked as "not confined". So, what about that being charming? Is everything bad? Or good, and it's just I'm an idiot? I tried to rename the system_tor profile to usr.sbin.tor and adjusted its name in the profile itself, but this only results in Tor being listed under "unconfined processes that have a profile defined" when typing "sudo aa-status". Anybody who can see clear in this issue? Any help is appreciated and thanks in advance. christian P.S.: I really did a "sudo service apparmor reload" ;-)

1 0

Tracking fast Tor exits
by Moritz Bartl 07 Nov '12

07 Nov '12

Hi, I wrote a small script today that keeps track of all "fast exits" as defined in https://trac.torproject.org/projects/tor/ticket/6498 . https://github.com/moba/tor-fast-exits-tracker Hourly updated output: https://www.torservers.net/tor-fast-exits.html Move mouse over dots to see the timestamp. -- Moritz Bartl https://www.torservers.net/

1 0

Fw: Undelivered Mail Returned to Sender
by syrus f 05 Nov '12

05 Nov '12

hello dear sir/madam I download tor (vidalia) on 05 Nov 2012 and I am in IRAN would you please tell me how remove problem step by step.

1 0

Status of NumCPUs >2 in 0.2.3.x?
by Steve Snyder 05 Nov '12

05 Nov '12

In the Tor v0.2.2.x series it was said that it was pointless to set NumCPUs to a value greater than 2. Due to poor scaling, I guess. Is that still the case with v0.2.3.24+ ? Would NumCPUs value of 4 or 8 (on systems with that many CPU cores) actually provide any benefit over a value of 2? Thanks.

2 1

Map of Tor Relays updated
by Moritz Bartl 28 Oct '12

28 Oct '12

Hi, I updated my small Python script that visualize Tor relays on Google Maps/Earth and OpenStreetMap. You can see the results generated today here: - All relays (2668): http://maps.burningsilicon.net/index.php?url=https%3A%2F%2Fwww.torservers.n… http://maps.google.com/maps?q=http:%2F%2Fwww.torservers.net%2Fmisc%2Ftormap… - Exits only (786 plus 153 "fast" exits >2MB/s) http://maps.burningsilicon.net/index.php?url=https%3A%2F%2Fwww.torservers.n… http://maps.google.com/maps?q=http:%2F%2Fwww.torservers.net%2Fmisc%2Ftormap… - Screenshot Exits only: https://www.torservers.net/misc/tormap/tormap.png - Download KML, eg. for use in Google Earth (works best): https://www.torservers.net/misc/tormap/tormap.kml https://www.torservers.net/misc/tormap/tormap-exitsonly.kml - Script: https://github.com/moba/tormap Colors: Red: Exits >2MB/s, Green: Exits <2MB/s, Yellow Star: Stable middle nodes >2MB/s, Yellow: Stable middle nodes <2MB/s, White: Other (unstable) I used the Maxmind GeoIP CityLite database. The markers might give a false impression of accuracy. Most IPs can only be tracked to city level (or even region), ie. the markers are somewhat near, not necessarily at the real location of the relay. -- Moritz Bartl https://www.torservers.net/

2 1

How to diagnose lack of traffic on bridge?
by Steve Snyder 27 Oct '12

27 Oct '12

I have a bridge that gets no traffic. I don't mean "hardly any" traffic; I mean none. The contents of bridge-stats are always empty except for the date, which advances once per day. In the state file the last date, apart from daily accounting entries, is a EntryGuardAddedBy entry from 09 Sep 2012. Yeah, that's six weeks ago. The log file contains only a weekly notice of log file rotation and a daily notice of bandwidth self-test. I never see errors or even warnings in the log. My bridge is not unstable. It has been running continuously for the last 25 days, which is pretty typical for this bridge. I understand that bridges can be identified and their IP addresses blocked. But I am not lacking traffic just from China, or just from Iran, or just from any other entity. It doesn't seem likely that my IP address has been blacklisted by *everybody*. I am also aware that the bridge authorities seem to favor handing out some addresses more than others. Really, though, this IP address is never given out at all? What are the odds of that? On the rare occasions that I restart the bridge, I see in the log that my ORPort is reachable from outside and that my server descriptor is being published. That's nice. Also, I am running the current stable version of Tor, so it is not a matter of obsolete software. How can I diagnose the failure of my bridge to garner any traffic? Thanks.

4 5

Need help: High capacity exit relay does not get traffic
by tor-admin 25 Oct '12

25 Oct '12

Hi, I am operating two 1 GBit/s servers which host 7 exit nodes. One server is located in GB with torland1 https://atlas.torproject.org/#details/4E377F91D326552AAE818D5A17BC3EF79639C… torland2 https://atlas.torproject.org/#details/332895D092C2524A3CDE8F6E1498FFE665EBF… torland1 is configured to run at maximum bandwidth, torland2 runs trottled to ensure not to exceed the 100TB contractual traffic limit. The nodes on this server get traffic as expected and are at the top of the Blutmagie Tor Status http://torstatus.blutmagie.de/index.php?SR=Bandwidth&SO=Desc. The second server is located in RO and hosts torland3 https://atlas.torproject.org/#details/E5DB403858511BB166405E4C43776D933A7B8… torland4 https://atlas.torproject.org/#details/E0D2F8B2A18516A5C935477B06048D7BD2E7E… torland5 https://atlas.torproject.org/#details/D2F1745C11843BC5AF09CB9D4027AD2BE5F1B… torland6 https://atlas.torproject.org/#details/43F9022028F8AB0F7420F702CB079DF0CA0C8… The configuration for the GB and RO nodes is: Nickname TorLandX ORPort 443 DirPort 80 Address a.b.c.d ORListenAddress a.b.c.d DirListenAddress a.b.c.d OutboundBindAddress a.b.c.d RelayBandwidthRate 30 MBytes # max 30 RelayBandwidthBurst 100 MBytes # max 100 MaxOnionsPending 250 NumCPUs 4 On both servers AES-NI is used by openssl. Although the server in RO has the same configuration, same operating system and a similar hardware, it does not get traffic as the server in GB. At the moment Atlas shows for torland3-6 only an advertised bandwidth rate of less the 3 MB/s. The GB node torland1 shows more than 30 MB/s. In order to test if there are any traffic limits I did several speed tests by doing up and downloads of a large 4GB iso image. Downloading simultaneously with 10 curl instances from different debian mirrors I measured around 1 GBit/s. To measure upload I stored the debian 4GB iso image on the webserver of the RO server and used curl on the GB server to download it from RO. The maximal measured upstream speed on the RO server was around 750 Mbit/s. Therefore I looks for me as there are no traffic limits inplace by my ISP or their upstream. One of the servers operated by Torservers.net is located in the same data center and runs wau, gorz and sofia at high speed. I am wondering why the directory authorities only measure such a small fraction of the available bandwidth for the RO nodes. Because I am paying personally for the server I would like to get most out of the server. Can someone who runs a tor authority please help me to understand what is the reason for the low observed bandwidth. Thanks, Torland

2 2

Announcing the Walla Walla Project
by admin 23 Oct '12

23 Oct '12

Hi, I'm representing the Walla Walla Project, a volunteer initiative that aims to support the Tor network by contributing (exit-)relays and bridges to the network, and I would like to quickly announce today's (initial) launch of our humble project to the Tor relay operator mailinglist. Without any further ado, our project website is available at http://wallawallaproject.org/ We certainly very much welcome questions, comments and suggestions! Have a great day. On behalf of the Walla Walla Project team, Thomas

5 10

Running relay on OpenBSD ulimit problems
by Gijs 18 Oct '12

18 Oct '12

Hey guys, I just created a new relay on my new firewall box thats running openbsd, however I'm running into issues with ulimits: Failing because we have 991 connections already. Please raise your ulimit -n. I tried editing login.conf (might be doing it wrong) to no avail Anyone able to help me out ? Gijs

2 2

openBSD question.
by sharon dvir 12 Oct '12

12 Oct '12

sorry to bother you guys, and i hope its not a dumb repeated question. but which of the two following options is preferred for an exit node on openBSD? - run the Tor package available through the openBSD repositories, which is 2.2.35 but probably been reviewed by the openBSD team. or - compile and use 2.2.39 which is not as obsolete? thanks

3 2

interesting sequence of messages
by Scott Bennett 10 Oct '12

10 Oct '12

I'm running 0.2.4.3-alpha and had to restart it during the night due to a system crash. As it was starting up, it put out the following sequence of messages. Oct 08 00:38:44.616 [notice] We now have enough directory information to build circuits. Oct 08 00:38:44.616 [notice] Bootstrapped 80%: Connecting to the Tor network. Oct 08 00:38:45.728 [notice] Bootstrapped 85%: Finishing handshake with first hop. Oct 08 00:38:46.130 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. Oct 08 00:38:46.359 [notice] Bootstrapped 90%: Establishing a Tor circuit. Oct 08 00:38:48.930 [notice] Our directory information is no longer up-to-date enough to build circuits: We have only 1868/2874 usable descriptors. Oct 08 00:38:48.930 [notice] I learned some more directory information, but not enough to build a circuit: We have only 1868/2874 usable descriptors. Oct 08 00:38:49.495 [notice] Tor has successfully opened a circuit. Looks like client functionality is working. Oct 08 00:38:49.495 [notice] Bootstrapped 100%: Done. Oct 08 00:38:49.830 [notice] I learned some more directory information, but not enough to build a circuit: We have only 1917/2874 usable descriptors. Oct 08 00:38:50.062 [notice] I learned some more directory information, but not enough to build a circuit: We have only 2013/2874 usable descriptors. Oct 08 00:38:50.142 [notice] I learned some more directory information, but not enough to build a circuit: We have only 2108/2874 usable descriptors. Oct 08 00:38:50.229 [notice] We now have enough directory information to build circuits. Oct 08 00:38:51.476 [notice] Self-testing indicates your DirPort is reachable from the outside. Excellent. Oct 08 00:39:03.079 [notice] Performing bandwidth self-test...done. The above really are nothing new, but just a really clear example of the screwiness of some common messages. In particular, the "no longer up-to-date enough to build circuits" and "learned some more directory information, but not enough to build a circuit" messages apparently are issued at times and under conditions contrary to the textual content of those messages. Let's examine the sequence shown above. 1) tor claims to have enough information to build a circuit. 2) It begins doing so by establishing the first hop of a testing circuit. 3) The testing circuit connects to my tor's own ORPort, so... 4) it builds a circuit to publish a descriptor and publishes it. 5) In less than 5 seconds from the time tor had enough directory information to build circuits, enough of that information has expired that tor no longer can build circuits. 6) tor fetches some descriptors, but still claims not to be able to build circuits. 7) tor announces that it has build a client-side circuit and pronounces that its startup is 100% complete. 8) tor continues to fetch three more batches of descriptors, saying that it still needs more to be able to build circuits, even after having claimed to have just built another one. I conclude from the above that the text of the messages claiming not to have enough directory information to build circuits is in error and should be revised to reflect the actual situation and events more accurately. Scott Bennett, Comm. ASMELG, CFIAG ********************************************************************** * Internet: bennett at cs.niu.edu * *--------------------------------------------------------------------* * "A well regulated and disciplined militia, is at all times a good * * objection to the introduction of that bane of all free governments * * -- a standing army." * * -- Gov. John Hancock, New York Journal, 28 January 1790 * **********************************************************************

2 1

Problems Setting up Bridge Relay on AWS
by freeflow＠mail.md 06 Oct '12

06 Oct '12

Hi! I recently set up a bridge relay on my home broadband connection. Unfortunately my ISP is restricting bandwidth during what it refers to as "peak hours", usually between 16:00 & 00:00 each day. This is obviously having a detrimental affect on my bridge relay as both upstream & downstream bandwidth is severely limited during these times. So I decided to set up a bridge relay on AWS, using the documentation at https://cloud.torproject.org/#get_started During the set-up process I've experienced 2 separate problems which I've described below. These are the actions I've taken: 1) I've successfully registered my account with AWS. 2) I've navigated my web browser to https://cloud.torproject.org/#get_started 3) At the above mentioned web page I've chosen: Obfsproxy Bridges (required ports: 22, 443, 52176) eu-west-1-Ireland 4) The pre-configured image is selected, and I'm directed to the AWS Management Console. When I arrive on the AWS Management Console page my web browser (Firefox 15.0.1) presents me with a "Warning: Unresponsive Script" dialogue box. The dialogue box explains, "A script on this page may be busy, or it may have stopped responding. You can stop the script now, or you can continue to see if the script will complete. Script: https://images-na.ssl-images-amazon.com/images [snip]... I chose to persevere & clicked "Continue" on the "Warning: Unresponsive Script" dialogue box. After being presented with another "Warning: Unresponsive Script" dialogue box I arrive at the "Choose an AMI" pane of the "Request Instances Wizard" which displays the pre-configured settings. It's at this stage that I begin to get confused... I've attempted to use the "Step-by-Step" instructions provided at https://cloud.torproject.org/#get_started The "Step-by-Step" instructions state, "Simply follow the steps as illustrated below, and your bridge will up and running in just a couple of minutes." With regard to the "Choose an AMI" pane the "Step-by-Step" instructions suggest, "Click "Continue". (No changes needed here.)" There doesn't appear to be an option to continue beyond the first pane (Choose an AMI), the only available option that I can see is to cancel (top right corner of the Choose an AMI/Request Instances Wizard pane). This takes me to the "Amazon EC2 Console Dashboard". However, because nothing has been set up, the EC2 Console Dashboard quite correctly informs me that there are no instances running. On the left-hand side of the Amazon EC2 Console Dashboard is the "Navigation" pane listing "Instances" & "Images" (including AMIs). So, I can see some of the required components that are incorporated into the "Request Instances Wizard" but I lack the experience to set up my AWS manually. So, more confusion! On the plus side the Amazon EC2 Console Dashboard does inform me that I've selected my chosen region which it reports is up & running. Maybe a "Continue" option isn't being displayed in the "Choose an AMI" pane because of the above-mentioned "Unresponsive Script" dialogue box, or maybe there's some other way to move through the "Request Instances Wizard" that I'm unaware of? I'm currently running java version 1.7.0_07 from Oracle Corporation on 12.04.1 LTS precise. I have no experience of setting up anything like an AWS so any help would be much appreciated & hopefully I can succeed in setting up my bridge relay! Best regards!

2 5

Re: [tor-relays] [tor-talk] clockskewer attack
by Eugen Leitl 03 Oct '12

03 Oct '12

----- Forwarded message from Ted Smith <tedks(a)riseup.net> ----- From: Ted Smith <tedks(a)riseup.net> Date: Wed, 03 Oct 2012 11:09:00 -0400 To: Eugen Leitl <eugen(a)leitl.org> Cc: cypherpunks(a)al-qaeda.net Subject: Re: [tor-talk] clockskewer attack The "attack" assumes that the targeted hidden service is running a Tor relay. On Wed, 2012-10-03 at 16:52 +0200, Eugen Leitl wrote: > ----- Forwarded message from Webmaster <webmaster(a)felononline.info> ----- > > From: Webmaster <webmaster(a)felononline.info> > Date: Wed, 03 Oct 2012 09:50:02 -0400 > To: tor-talk(a)lists.torproject.org, tor-relays-request(a)lists.torproject.org > Subject: [tor-talk] clockskewer attack > User-Agent: Mozilla/5.0 (X11; Linux x86_64; > rv:15.0) Gecko/20120912 Thunderbird/15.0.1 > Reply-To: tor-talk(a)lists.torproject.org > > Found some interesting news on reddit. I dont know the tech behind it, > but is sounds like playing with Clock allows you to get the IP address of > the hidden service > > http://www.reddit.com/r/onions/comments/10usgv/clock_skewing_a_clever_uncon… > > http://pastebin.com/PfXUm3VQ > > > Is this something to be worried about? > _______________________________________________ > tor-talk mailing list > tor-talk(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk > > ----- End forwarded message ----- -- Sent from Ubuntu ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE _______________________________________________ tor-talk mailing list tor-talk(a)lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

1 0

Fwd: Ongoing, repetitive, flooding and abuse on Usenet newsgroup ba.broadcast from your site
by Michael Renner 02 Oct '12

02 Oct '12

Hi List, I run a relay-only and an exit node without too much hassle, today I received this mail and am not too sure what to make out of it. A fellow requests that I shall block access to Google Groups because somebody is using Tor to spam groups there. My gut feeling is that if they know the identity of this fellow they should just go the legal route and be done with it. Any opinions/insights from your side? all the best, Michael Begin forwarded message: > From: "Paul W. Schleck" <pschleck(a)oasis.novia.net> > Subject: Ongoing, repetitive, flooding and abuse on Usenet newsgroup ba.broadcast from your site > Date: October 2, 2012 2:30:11 GMT+01:00 > To: groups-abuse(a)google.com > Cc: abuse(a)co.at, abuse(a)amd.co.at > > Note to TOR Exit Server maintainers: > > This article is from Google Groups, a third-party news posting site via > http (80 port). I have received replies from other TOR exit server > maintainers that they will temporarily block connectivity to Google > Groups' range of IP addresses, as this kind of repetitive flooding to > deny use of a newsgroup is not free speech, and not what the TOR project > was intended to be used for. The IP addresses for Google Groups are as > follows: > > groups.google.com canonical name = groups.l.google.com. > Name: groups.l.google.com > Address: 74.125.142.102 > Name: groups.l.google.com > Address: 74.125.142.113 > Name: groups.l.google.com > Address: 74.125.142.138 > Name: groups.l.google.com > Address: 74.125.142.139 > Name: groups.l.google.com > Address: 74.125.142.100 > Name: groups.l.google.com > Address: 74.125.142.101 > > Name: googlegroups.com > Address: 74.125.142.99 > Name: googlegroups.com > Address: 74.125.142.103 > Name: googlegroups.com > Address: 74.125.142.104 > Name: googlegroups.com > Address: 74.125.142.105 > Name: googlegroups.com > Address: 74.125.142.106 > Name: googlegroups.com > Address: 74.125.142.147 > > Google Groups would otherwise have to implement blocking of your exit > nodes to stop this flooder. The security practices of sites under my > control are fine, including blocking of all TOR exit servers. > > The article quoted below is one of thousands over the past year. I can > send you far worse examples, if required. A good sampling of the > perpetrator's mental state, and criminal record, may be found at: > > http://www.smbtech.com/ras/ > > This is some voluminous, off-topic flooding and harassment on the > ba.broadcast Usenet newsgroup. It is being reported to abuse reporting > mailboxes based on the contents of the NNTP-Posting-Host: and > X-Complaints-To: headers, and lookup of the originating IP address via > WHOIS and the Network Abuse Clearinghouse. They are sometimes also > crossposted to unrelated newsgroups such as rec.arts.tv, > soc.culture.new-zealand, and several other newsgroups in the nz.* > hierarchy. It is disruptive, and completely off-topic, as well as > causing disruptive, cascaded flame wars among those unrelated > newsgroups. > > This user has also been posting from other sources, including 100tb.com, > 31173.se, 51.net, 62.net, all.de, armax.me, artelco.com, bahnhof.se, > bigkitten.net, boingboing.net, broadviewnet.net, bu.edu, ccc.de, co.at, > coolhousing.net, creekcabin.com, dfri.se, exit.de, einteilung.at, > finalhosting.cz, formlessnetworking.net, ghst.net, hessmo.com, > hexhost.net, ib.de, ipredator.se, mydev.net, noisetor.net, oceanic.net, > ovh.net, plebia.org, ovh.net, privacyfoundation.ch, privacyrepublic.org, > progressbar.sk, riseup.net, ru.is, sbcglobal.net, scnet.net, > servers.com, snydernet.net, solidonetworks.com, stanford.edu, > stargrave.org, techfixuk.com, torland.is, torland.me, torservers.net, > trolling.me, dmzglobal.com, telstraclear.net, xtra.co.nz, clear.net.nz, > orcon.net.nz, netgate.net.nz, freeparking.co.nz, powerusenet.com, > giganews.com, thundernews.com, altopia.com, comcast.net, > groups.google.com, and tigerusenet.com. It appears that you are merely > the latest of his victims. > > The charter of ba.broadcast is as follows: > > "This group is here for discussions, comments and program reminders > about broadcast media in the San Francisco Bay Area, both radio and > television. It also includes cable systems and TVRO/BCRO in the SF Bay > Area. It does not include scanner, ham radio or other action here in > the SF Bay Area; these may be addressed in another newsgroup at another > time. Issues of national interest should be posted to one of the groups > in rec.arts.tv or rec.radio." > > (see: http://groups.google.com/group/ba.broadcast/browse_thread/thread/ddfbd8175e…) > > The charter does not include sexual innuendo and libel, abusive threats, > bigotry and minority bashing, or any off-topic discussion of subjects > not reasonably related to broadcasting in the Bay Area, which now > consitute the overwhelming majority of current message traffic on > ba.broadcast, to the detriment and exclusion of on-topic participation > by others. > > Please take appropriate action to put a stop this this misbehavior > originating from your site that is disrupting ba.broadcast. > > > Offending article follows: > > > Received: by 10.224.223.84 with SMTP id ij20mr14306706qab.5.1349116799161; > Mon, 01 Oct 2012 11:39:59 -0700 (PDT) > MIME-Version: 1.0 > Received: by 10.224.33.136 with SMTP id h8mr4922241qad.1.1349116799065; Mon, > 01 Oct 2012 11:39:59 -0700 (PDT) > Path: novia.net!newscene!newscene.com!novia!news-out.readnews.com!transit3.readnews.com!209.85.216.87.MISMATCH!l8no19978676qao.0!news-out.google.com!e10ni152738478qan.0!nntp.google.com!l8no19978674qao.0!postnews.google.com!l18g2000vbv.googlegroups.com!not-for-mail > Newsgroups: ba.broadcast,alt.radio.talk,alt.radio.broadcasting,alt.sports.football.pro.sf-49ers,alt.sports.football.pro.oak-raiders > Date: Mon, 1 Oct 2012 11:39:58 -0700 (PDT) > Complaints-To: groups-abuse(a)google.com > Injection-Info: l18g2000vbv.googlegroups.com; posting-host=212.232.24.57; posting-account=amCOWAkAAABZSaz2UHdaAM8n23Z-gMLO > NNTP-Posting-Host: 212.232.24.57 > User-Agent: G2/1.0 > X-HTTP-Useragent: Mozilla/5.0 (Windows NT 6.1; rv:10.0) Gecko/20100101 Firefox/10.0,gzip(gfe) > Message-ID: <95a49153-6779-42a1-802a-fd3a121c872b(a)l18g2000vbv.googlegroups.com> > Subject: JEW: Layer 42 Inc. (Mtn. View) KAITLYN RUBIN: Satanic Ritual Abuse > (S.R.A.) S.teve R.ubin A.irplanes .^ > From: "Jose' Scott Satanist Drug Dealer Outlaw [kzsu fm]" <zyklon_bozo(a)yahoo.com> > Injection-Date: Mon, 01 Oct 2012 18:39:59 +0000 > Content-Type: text/plain; charset=windows-1252 > Content-Transfer-Encoding: quoted-printable > Xref: novia.net ba.broadcast:285031 alt.radio.talk:296685 alt.radio.broadcasting:60948 alt.sports.football.pro.sf-49ers:539274 alt.sports.football.pro.oak-raiders:296436 > > Layer 42 Inc. (Mtn. View) > Steve Rubin Satanic Ritual Abuse > Kaitlyn Rubin (daughter) and clear case of > child abuse, neglect and well known worldwide > satanic JEW child pedophilia "faith" racket: > > Steve Rubin (CEO President) > Layer 42 Inc. > Mountain View California > > Rubin's Abused Child: > > http://www.exorcist.org.nz/kaitlyn-whothehellareyou_1.jpg > http://www.exorcist.org.nz/kaitlyn_scabs_bruises_parched.bmp > > THAT LOOK OF TERROR IN THE YOUNG GIRL'S FACE (below) > > KAITLYN RUBIN: > * Bruises > * Swollen Lips > * Snot Filled Nose > * Multiple Marks On Face > * Beatings > * Domestic Violence Against Children > * Sexual Abuse (see below about jews \ pedophilia) > > Steve Rubin (CEO President) > Layer 42 Inc. > Mountain View California > > Steve Rubin also owns a small airplane, which coincides > with the facts that have been released involving the McMartin > Pre-School child abuse scandal years ago. The facts > un-covered prove that the children were actually flown by > a small airplane to a location in the mountains and then > Satanic Ritual Abuse (S.R.A.) occured, and then the > children were flown back to the Pre-School prior > to being picked-up by the parents. > > Steve Rubin's closest friends are admitted and proven > luciferians (satanists) > > THE LUCIFERIAN CONSPIRATORS > http://www.exorcist.org.nz/citizen_cohn_luciferian_higdon_byrd.html > > "Eric Conspiracy" > http://www.catb.org/~esr/ecsl/ > > ------------------------------------- > > From Webpage: > http://www.exorcist.org.nz/music_mafias.html > > It just so happens that an anti-christ styled JEW, named : > > S t e v e R u b i n > > who happens to work for Napster (world-wide piracy), who was so > offended that I & I offered criticism of the whole pirate now > so-called "company" of thieves, Napster. Once again, a JEW is > involved in is involved in filthy ill-gotten monies, filthy lucre, > from another, evil JEW in the music scene, and this time it is > the cold-blooded terrorist JEW named Steve Rubin, who is > stalking me personally, both at work and and at my residence. > I feel like Jesus (Y'shua) Christ sometimes, when evil luciferian > satanic JEWS (Revelation 2:9) are trying their best to smear > I & I, to stop I from witnessing to the JEW conspiracy alive > like a satanic (Revelation2:9) monster, after having killed > Jesus (Y'shua) Christ. . . > > Steve Rubin had published, publicly, and cached by Google, > photos of his own daughter Kaitlyn, on his web-page. > > The only problem for Steve Rubin (evil JEW spirit of anti-Christ), > is that the photo below shows clearly that neglect is rampant > in the Rubin "household". . . . where "daddy" Steve Rubin, the > evil anti-christ who is stalking me personally, and taking pride > in his small private airplane that he bothers the South Bay of > Santa Clara Valley, etc. with the noisey engines. You have all > heard them before . . . the noisey private planes, and of course > all of the accidents caused by private piloted aircraft. With > the knowledge that the JEWS who owned, leased Bldg. 7 of the > World Trade Center, and did "pull-it", whereby it came down, > and wasn't hit by the planes . . . where also a group of Israelis > were caught filming the whole 911 event, were arrested and > then released. > > I am deeply concerned, when a JEW TERRORIST like Steve > Rubin, who is hunting me down, making I & I feel like I am > Jesus or something . . . . a JEW conspiracy, > and a JEW TERRORIST, like Steve Rubin, who has access > to an airplane, could of course be so crazy as to attempt > another infamous airplane terror event, once again staged > by the JEWS ! > > Steve Rubin's daughter Kaitlyn, with picture below, definately > shows neglect, and most poignantly, the inability for a JEW to > fight the urge to buy a Kleenex (too cheap JEW) for his own > daughter . . . . but rather, it is more likely that he is just a > S H I T T Y " F A T H E R ". The pictures tell all. > > Notice if you will, the bruises, sores, cuts, parched and chapped > lips, nostril openings that are completely crusted and not clean > enough for proper breathing, thus Steve Rubin is actually > suffocating his own daughter, by not cleaning the air passages > that lead to the baby's lungs. Parched lips usually means that > the child probably doesn't get enough liquids fed to her also, > yet another case of neglect by a "father" who is probably > playing stupid, and I did say stupid video games, like all > computer dweebs like JEW Steve Rubin actually is. > > --------------- > > The only thing Steve Rubin has ever done in radio, is to turn > on the damn appliance at home, to probably tune-in to > something dark and demonic, like what the JEW Talmud > demand of their leaders, and that is that they, the Jew > leaders, rabbis, MUST BE SORCERERS. > More on that, below ! > > Evil JEW Steve Rubin, who is on a warpath against I & I, > because he is a miserable, evil, terrorist (with plane), that > has tried his best to hunt me down, like some Pharisee Jew > hunting Jesus (Y'shua) Christ . . . > > What is funny is that JEW Steve Rubin, would most likely > rail against and attack the philosophy and practice of > suffocating Jews in the bogus German showers of WW2. > > --When in all actuality, it is - > --who wants to do things his own way, > --suffocating his own daughter in his own > --method - by blocking her air passages (nose) . > Good going Rubin ! > --Keeping one-self dirty, like a dirty JEW, > --a dirty JEW family, just like the > > VERMIN ANTI-CHRIST YOU ARE RUBIN ! > > How dare you come and test I & I, and try to conspire and > lie about the I, with a smear of lies, coming from a miserable > evil JEW like you Rubin. > > The Talmud (JEW Text) gives complete approval for Adult-Child > Sex. Therefore I want to know where all of those bruises are > coming from. Is the child being sexually abused by Steve Rubin ? > Coming from a "religion" which gives support, and urges such > Adult-Child Sex activity - See Below For Information on the Talmud > and Adult-Child Sex. > > Let's see, we have Steve Rubin who is the spirit of antichrist > "father" who abuses his own daughter (snot nose / parched > lips / bruises / sores) > NEGLECT, who is coming after me, and amazingly labels > the photo that is above of Kaitlyn, " Hell ". I kept the picture > file name intact, exactly how Steve Rubin named his daughter. > http://www.exorcist.org.nz/kaitlyn-whothehellareyou_1.jpg > > Steve Rubin (CEO President) > Layer 42 Inc. > Mountain View, California > http://www.layer42.net/contact/ > > ~ THE FLAME ~ > Steve Rubin Anti-God Anti-Christ Satanist > Layer 42 Inc. Mtn. View, CA > Child Neglect =3D Child Abuse > Jew Sanctioned Regulated Pedophilia > http://www.exorcist.org.nz/music_mafias.html > > ------------------------------------------------ > > JEW REGULATED PEDOPHILIA > (Talmud, Torah, Kabbalah) > > Permits Child-Adult Sex > Talmud law permits sexual intercourse between > children and adults. > > This doctrine is contained in a number of Mishnahs. > Before we examine them, however, it is necessary > that the reader be familiar with the word kethubah. > According to the Soncino Talmud Glossary: > > " KETHUBAH (Lit., 'a written [document]'); (a) a wife's marriage > settlement which she is entitled to recover on her being divorced > or on the death of her husband. The minimum settlement for a virgin > is two hundred zuz, and for a widow remarrying one hundred zuz; > (b) the marriage contract specifying the mutual obligations > between husband and wife and containing the amount of the endowment > and any other special financial obligations assumed by the husband. " > > =97 Babylonian Talmud, Soncino Talmud Glossary > > Zuz is a unit of currency. We see, then, that a dollar (or zuz) > value is put on virginity. > > Now let's look at a Mishnah from Kethuboth 11a: > " MISHNAH. WHEN A GROWN-UP MAN (7) HAS HAD SEXUAL > INTERCOURSE WITH (8) A LITTLE GIRL, (9) OR WHEN A SMALL > BOY (10) HAS INTERCOURSE WITH A GROWN-UP WOMAN, OR > [WHEN A GIRL WAS ACCIDENTALLY] INJURED BY A PIECE OF > WOOD (11) =97 [IN ALL THESE CASES] THEIR KETHUBAH IS TWO > HUNDRED [ZUZ] =85 " > > =97 Babylonian Talmud, Tractate Kethuboth 11a > > Soncino 1961 Edition, page 57 > The translator, Rabbi Dr. Samuel Daiches, amplifies the text > with footnotes: > " A man who was of age. > Lit., 'who came on'. > Less than three years old. > Less than nine years of age. > Lit., 'One who was injured by wood', as a result of which she > injured the hymen. " > > =97 Rabbi Dr. Daiches > > Let's review the above-cited Mishnah: "When a grown-up man has > had sexual intercourse with a little girl, or when a small boy > has intercourse with a grown-up woman =85" It is obvious that > sex activity between a grown man and a little girl, and between > a grown woman and a little boy, is a part of the woof and the > warp of everyday Talmud life; such relationships, in the eyes > of the Sages, are unremarkable. > There is no prohibition on sexual activity between adults and > young children =97 it is simply regulated. Recall the words of > the Very Reverend the Chief Rabbi of the British Empire, the > late Dr. Joseph Herman Hertz: > > " Religion in the Talmud attempts to penetrate the whole of > human life with the sense of law and right. Nothing human is > in its eyes mean or trivial; everything is regulated and > sanctified by religion. Religious precept and duty accompany > man from his earliest years to the grave and beyond it. > They guide his desires and actions at every moment. " > > =97 Rabbi Dr. Hertz > > Thus, if the Talmud permits girls three years old and younger > to be sexually used by adults, that is the law. The concern of > the Sages is to ensure that the adult is not, technically > speaking, in violation of any of the rules. > > > >

1 0

Re: [tor-relays] tor-relays Digest, Vol 20, Issue 24
by Mike Edwards 01 Oct '12

01 Oct '12

Hi, thanks all. It looks like the port forwarding is not working. I get the message below when I try the test suggested. I guess it must be something to do with the modem router and when I get a chance I'll try testing if I can get any incoming traffic - not sure how best to do this though...maybe set up an FTP server and try to access it! I'm also thinking of using a proxy. My friend suggested hidemyass.com any other suggestions would be really gratefully received. Thanks again, all really helpful replies. Cheers, M The requested resource could not be loaded. libcurl returned the error: couldn't connect to host

1 0

Directory Port Reachability Test Failed?
by Mike Edwards 28 Sep '12

28 Sep '12

Hi There, I have been keeping a causal eye on Tor for quite a few years now and have been getting more and more worried about the data/meta data that is being collected and the known and unknown micro and macro ways in which it can be used to harm/manipulate individuals, groups and societies. Anyway, last week I got a new Android phone and installed Orbot and then happened to watched the latest Juiced Media Rap News which prompted me to set up Tor on my Linux laptop. Since then I have (for the last few days) been trying to set up a Tor relay to help the community but haven't managed. I have read quite a few guides including the one on the TorProject site (https://www.torproject.org/docs/tor-doc-relay.html.en) I'm pretty stuck and hoping someone might be able to help? My hardware set up is: Boradband phone line into > modem router (no wireless and only 1 out going Ethernet port - I have tried login into this box but can't!) plugged in via Eithernet into > Netgear wireless router which communicates over wireless with my > Thinkpad laptop running Ubuntu 12.04 (see a photo my modem router and wireless router set-up here: http://flossnotes.blogspot.co.uk/2012/09/tor-relay.html ) I have Tor set up as a relay as per the configuration guide (see screenshots of the "Sharing tab (everything else is default)*. I have set up port forwarding on the Netgear wireless router for ports 9001 and 9030 (see screenshot*). I have stopped my Laptops fire wall using Fire Starter. And, in desperation I have even set-up my laptops IP in the DMZ settings on the Netgear wireless router (see screenshot*) *photos and screen shots here: http://flossnotes.blogspot.co.uk/2012/09/tor-relay.html Again in more detail... 1) I have Tor running and my internet traffic from Firefox is going through it. I know this because when I visit: https://check.torproject.org/ I'm met with the message "Congratulations. Your browser is configured to use Tor" and I get these messages in the Tor message log "[Fri Sep 28 14:22:32 2012] The Tor Software is Running - You are currently running version "0.2.3.22-rc (git-4a0c70a817797420)" of the Tor software." "[Fri Sep 28 14:23:28 2012] External IP Address Changed - Tor has determined your relay's public IP address is currently xx.xxx.xx.106. If that is not correct, please consider setting the 'Address' option in your relay's configuration." "[Fri Sep 28 14:23:38 2012] Connected to the Tor Network - We were able to successfully establish a connection to the Tor network. You can now configure your applications to use the Internet anonymously." 2) I have followed the configuring Tor relay guide and get these messages, "[Fri Sep 28 14:23:38 2012] Checking Server Port Reachability - Tor is trying to determine if your relay's server port is reachable from the Tor network by connecting to itself at xx.xxx.xx.106:9001. This test could take several minutes." "[Fri Sep 28 14:43:28 2012] Server Port Reachability Test Failed - Your relay's server port is not reachable by other Tor clients. This can happen if you are behind a router or firewall that requires you to set up port forwarding. If xx.xxx.xx.106:9001 is not your correct IP address and server port, please check your relay's configuration." (I get the same message for port 9030 - Directory) 3) I have configured my Netgear router to forward ports 9001 and 9030 asa per the instructions here: http://portforward.com/english/routers/port_forwarding/Dlink/DIR-655/ 4) I have stopped my laptops firewall. 5) On the Netgear router I have set up my laptops IP to sit outside of the firewall in the "DMZ" so as far as I understand, it should be exposed to all external requests! Sorry for such a long first post. I'm pretty frustrated! Any help would be much appreciated. Cheers, Mike

3 2

Re: [tor-relays] Directory Port Reachability Test Failed?
by eliaz 28 Sep '12

28 Sep '12

This link may be relevant: https://trac.torproject.org/projects/tor/ticket/6979 It relates to what seems to be the same problem, occurring on the latest version (ver .39, TBB for windows). - eli On 9/28/2012 12:48 PM, Mike Edwards wrote: [snip] > "[Fri Sep 28 14:23:28 2012] External IP Address Changed - Tor has > determined your relay's public IP address is currently xx.xxx.xx.106. If > that is not correct, please consider setting the 'Address' option in > your relay's configuration." [snip] > 2) I have followed the configuring Tor relay guide and get these messages, > > "[Fri Sep 28 14:23:38 2012] Checking Server Port Reachability - Tor is > trying to determine if your relay's server port is reachable from the > Tor network by connecting to itself at xx.xxx.xx.106:9001. This test > could take several minutes." > > "[Fri Sep 28 14:43:28 2012] Server Port Reachability Test Failed - Your > relay's server port is not reachable by other Tor clients. This can > happen if you are behind a router or firewall that requires you to set > up port forwarding. If xx.xxx.xx.106:9001 is not your correct IP address > and server port, please check your relay's configuration." > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays [snip]

1 0

about setting up a tor exit node
by esolve esolve 27 Sep '12

27 Sep '12

Hi, I installed tor browser bundle and I want to use vidalia to set up a tor exit node with my computer. However, I have problem in port forwarding, my computer is inside an institute, and I'm not clear about the firewall setting. Is there any method for me to check the firewall setting and make a hole on it? thanks!

2 3

Re: [tor-relays] some questions
by eliaz 26 Sep '12

26 Sep '12

I can't answer your questions, but to help with problems I've been having, can you say which version of the TBB you're running, & on what OS? - eli On 9/24/2012 1:37 PM, esolve esolve wrote: > Hi, all: > > I'm newbee here. I have some questions: > > I'm using tor with vidallia as a TOR client and I use > wireshark/tcpdump to capture the packets, I notice that in vidalia, when > I select "view the network" and in the "connection status" window, I can > see many hosts, I think they are entry nodes which my tor client is > connecting to, so it means there are many circuits established for my > tor client. But the Tor web browser shows that my ip address appears to > be 80.237.226.73, so this is the only exit nodes. So how can I know > which entry node (or circuit) I'm actually using with this exit node? > > The tcp stream between the tor client and the entry node should be > TLS-encrypted, but when I open a web page, I noticed that the stream is > actually TCP not TLS, is there anything wrong? > > > > Beisides, I want to use my computer as an exit node and I use > vidalia to enable it, however, I noticed on the "connection status" > window that many nodes failed to connect to my computer, are there > anything that should be taken care of in setting up an exit node? > > thanks! > > > > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > -- gpg: 0x3E346824

1 0

Re: [tor-relays] Bridge relay: conversing with the message log
by eliaz 26 Sep '12

26 Sep '12

Well, I'm glad I didn't listen. TBB ver 0.2.2.39 gave me a hell of a time before a recognizable bug msg came thru in the log. Had to roll back to ver .38 in order to get the bridge reliably online again. - eli On 9/22/2012 7:57 AM, Roger Dingledine wrote: > On Thu, Sep 20, 2012 at 08:25:05AM -0400, eliaz wrote: >> Despite these info lines Tor finally claims success. Does this mean >> that I can ignore the previous info lines? Or are they telling me that >> I have to do something? As far as I can tell my bridge is working fine. > > Tor logs at log-level notice by default for a reason -- we don't expect > you to look at, or understand, info or debug logs. > > Or said another way, if Tor isn't complaining to you with notice, warn, > or err messages, you can assume everything is going smoothly. > > See also > https://trac.torproject.org/projects/tor/wiki/doc/TorFAQ#Whatloglevelshould… > > --Roger > > _______________________________________________ > tor-relays mailing list > tor-relays(a)lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays > -- gpg: 0x3E346824

1 0

some questions
by esolve esolve 24 Sep '12

24 Sep '12

Hi, all: I'm newbee here. I have some questions: I'm using tor with vidallia as a TOR client and I use wireshark/tcpdump to capture the packets, I notice that in vidalia, when I select "view the network" and in the "connection status" window, I can see many hosts, I think they are entry nodes which my tor client is connecting to, so it means there are many circuits established for my tor client. But the Tor web browser shows that my ip address appears to be 80.237.226.73, so this is the only exit nodes. So how can I know which entry node (or circuit) I'm actually using with this exit node? The tcp stream between the tor client and the entry node should be TLS-encrypted, but when I open a web page, I noticed that the stream is actually TCP not TLS, is there anything wrong? Beisides, I want to use my computer as an exit node and I use vidalia to enable it, however, I noticed on the "connection status" window that many nodes failed to connect to my computer, are there anything that should be taken care of in setting up an exit node? thanks!

1 0

Tor Weather Statistics
by tagnaq 23 Sep '12

23 Sep '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Torproject, would you mind publishing a few Tor Weather statistics? (I assume publishing this information is safe) How many relays have at least one Tor Weather subscription? How many subscriptions did tick the checkbox for: 'Email me when the router's Tor version is out of date'? How many 'Node Out of Date!' emails did you send out today? :) -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAlBfZgsACgkQyM26BSNOM7ZmgwD8CEj9H64NF0lePd+Cr65ECcLW 1CvFTbZau/m/3m7Ef9kA/3S+cGJfcS6xPtHcNZbnRa9FC8QXlP6P9QAgkhXhny2b =3lHr -----END PGP SIGNATURE-----

1 0

'critical' security update: Tor 0.2.2.39
by tagnaq 23 Sep '12

23 Sep '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 It is quite sad that one has to find out about 'critical' security updates [0] via an unrelated thread on tor-talk [1] or the blog [2] instead of getting an announcement on tor-announce [3] - where relay operators are probably expecting such information. Are tor versions 0.2.3.x and 0.2.4.x affected too? [0] https://gitweb.torproject.org/tor.git/blob/release-0.2.2:/ReleaseNotes https://trac.torproject.org/projects/tor/ticket/6811 [1] https://lists.torproject.org/pipermail/tor-talk/2012-September/025525.html [2] https://blog.torproject.org/blog/new-bundles-security-release [3] https://lists.torproject.org/pipermail/tor-announce/ -----BEGIN PGP SIGNATURE----- iF4EAREKAAYFAlBUV7cACgkQyM26BSNOM7ZeyAEArFSwM5Z0fhtXV6q7pdK9CqXV coEuuHUFrm6gjzkQ+p8A/2z2e+x4sYuJzKhlvFKnwCURw93FSqWEt5MCFRpkd6rV =FkRi -----END PGP SIGNATURE-----

2 3

bridge usage-panel behavior
by eliaz 22 Sep '12

22 Sep '12

Over the last week or so my bridge usage has been zero, whereas previously it would show clients for at least a few and usually many countries. The only exception is China, which comes up well within an hour of enabling the bridge. Usually the usage display stops at 1-8, but sometimes it shows continuing Chinese use. The bandwidth graph sometimes shows high, but not extraordinary, traffic. Usually it's quiet, and there's been no filling-up of the bandwidth. At a machine running through a different ISP, I logged on as a client looking to use my bridge address. As expected, when I got home I saw that the bridge usage registered USA 1-8 as well as the usual China 1-x. From this experiment I gather at least that my setup is working fine. So I'm wondering if the Chinese client(s) is/are inhibiting other contacts, and if so, if this apparent locking onto China is a network glitch or intentional interference. As the first step I thought I'd ask here: Has anyone else noticed an apparent locking of China (or some other country) in your usage panel? - Thanks, eli

1 0

Re: [tor-relays] Bridge relay: conversing with the message log
by eliaz 22 Sep '12

22 Sep '12

Stephen - I can't thank you enough for the clarification. I's a great help to my understanding of how Tor interacts with ISPs. - eli On 9/20/2012 3:24 PM, Stephen Mollett wrote: > Hi Eli, > > On Thursday, 20 September 2012, 13:25, eliaz <eliaz(a)tormail.org> wrote: > >> ... >> Sep 20 07:33:43.872 [Info] resolve_my_address(): Guessed local hostname >> '<NAME>' resolves to a private IP address (<ISP address>). >> Trying something else. >> Sep 20 07:33:43.872 [Info] resolve_my_address(): Interface IP address >> '<LAN address>' is a private address too. Ignoring. >> ... > >> In particular, what does it mean that the <LAN address> is being >> identified as private? > > > "Private address" in the context of an IP address usually refers to an address in one of the reserved ranges which are set aside for use on private networks and which can't be routed to over the internet. These ranges are 192.168.*.* (the commonest one, used by most home routers when issuing addresses to clients), 10.*.*.* (fairly common, especially in corporate networks) and 172.16.*.*-172.31.*.* (not seen very often). 100.64.*.*-100.127.*.* is also reserved for ISPs to use, primarily to help ease the transition from the old-style 32-bit IPv4 addressing system (addresses that look like 173.194.69.99 which is one of the addresses for www.google.com) to 128-bit IPv6 addresses (which look like 2a00:1450:4008:c01::68 - also www.google.com) > > > It's not surprising that your LAN address is a private one (most likely in 192.168.0.* or 192.168.1.* depending on what router you have); your ISP may also be using private addresses, at least for its residential customers. If your ISP does allocate you a private address, your reachability from the public internet is largely dependent on how their NAT and firewalling system works. Publishing the private address won't work, though, as it could be used by many different ISPs (or even multiple times by the same ISP!) > > > Hope this sheds a little light on the log entries. > > Stephen > > > -- gpg: 0x3E346824

1 0

Bridge relay: conversing with the message log
by eliaz 22 Sep '12

22 Sep '12

I run a bridge relay on vista x64 through my ISP's router-modem firewall. I need some help in understanding a few lines in the message log. Replacing the name of machine on my LAN by <NAME> and the IP addresses by <LAN address> and <ISP address> (= the bridge's address), the lines are: Sep 20 07:33:43.872 [Info] resolve_my_address(): Guessed local hostname '<NAME>' resolves to a private IP address (<ISP address>). Trying something else. Sep 20 07:33:43.872 [Info] resolve_my_address(): Interface IP address '<LAN address>' is a private address too. Ignoring. Sep 20 07:33:43.872 [Info] resolve_my_address(): Address '<NAME>' resolves to private IP address '<LAN address>'. Tor servers that use the default DirServers must have public IP addresses. Sep 20 07:33:43.872 [Info] router_pick_published_address(): Could not determine our address locally. Checking if directory headers provide any hints. Sep 20 07:33:43.872 [Info] router_pick_published_address(): Success: chose address '<ISP address>'. I don't know if these lines are telling me something about the bridge. In particular, what does it mean that the <LAN address> is being identified as private? This doesn't change regardless of the setting on my local LAN firewall to "public", "private", "domain" or "all". Does Tor mean by "private" simply the LAN address, and by "public" the ISP address? Despite these info lines Tor finally claims success. Does this mean that I can ignore the previous info lines? Or are they telling me that I have to do something? As far as I can tell my bridge is working fine. Thanks, eli

3 2

Min. Bandwidth for Bridge Relay?
by freeflow＠mail.md 20 Sep '12

20 Sep '12

Hi! I have around 50-60 KB/s of bandwidth that I'd like to use for running a bridge relay. Is this a sufficient amount of bandwidth? I ask because it doesn't seem like very much compared to the amounts that others donate to the tor network. Tor documentation suggests as little as 20 KB/s can be used to run a tor relay but this seems to be a very low badwidth rate. >From looking at the tor status web page via blutmagie.de it would seem that there some low bandwidth relays but are these really useful or too slow to be useful to the tor network? If someone can confirm that 50-60 KB/s for bridge relay is useful then I would go ahead & run my bridge relay. Best regards,

6 6

Re: [tor-relays] bwadv vs bwhist + implications
by torhoste＠tor.host-ed.me 20 Sep '12

20 Sep '12

> hello there! > very interesting information you shared here, thank you. > while i dont have any further information to rely on, > i would still like to share a few simple thoughts. > You're welcome. > lets assume for a second that there are no errors in the code and that Tor > is not using a significantly less than optimal network topology. > > i would argue against adjusting the traffic limit as you suggested, for > the > following reasons: > -pending more data, this ratio might arbitrarily change at any point in > time, > causing either under utilization of the network. which is what you have > set > out to prevent. > or over utilization which will cause troubles to the relay admins, > like throttling by providers. > I clearly see where you're coming from. While I *certainly* do not propose a large-scale adjustment in relay configurations (that isn't my incentive actually), I still seriously think about doing the adjustments - certainly with some offset to the observed figures to address potential over-utilization - for our very own relays. We're looking forward to receive some sponsored VPS(s) that we would like to dedicate/contribute to the Tor network and I'm somehow concerned, i.e. think it's unfortunate, that - expectedly - 1/3 of our monthly traffic limit(s) wouldn't be used after all. That said, please have a brief look at https://metrics.torproject.org/bandwidth.png?start=2010-09-19&dpi=72&end=20… - i.e. a two-year bwadv vs bwhist sample of the whole Tor network. It actually shows a rather significant trend of the "1/3 bwadv vs bwhist discrepancy" I observed previously. > -its important to have more capacity then needed, this allows better > stability and is helpful with dealing with sudden increases in Tor use, a > somewhat common event, > Same here. I wouldn't want to argue against your assumptions as they - from a general/common-sense perspective - make perfect sense. Still, looking at the two-year sample graph, I cannot really see such a network behavior, i.e. sub-samples where the gap between bwadv vs bwhist would be significantly lower at times. > of course, this is not to take away anything from your observation and > initiative. > who knows, you might have found a serious problem with the network. > I don't think there's a serious problem with the network. I just would like to ask the list for the actual reasoning of the, from my perspective rather *large*, discrepancy. You named three (actually two) things: 1. under-/over-utilization: the trend seems to be pretty constant and with some offset calculated in, I would look forward to avoid over-utilization (just for our own initiative certainly) and thus potential throttling by providers for our very own contribution to the network. 2. adjustments to peak traffic: While I totally understand the argument, I just can't see that happening (at least) within the last two years looking at the sample graph. thanks a lot for your feedback! Please don't get me wrong counter-arguing. I'm just considering opportunities for our own initiative and clearly see the general validity of your argumentation. Also I wouldn't want to exclude the possibility that I'm missing something important here and would like to ask everyone concerned to tell me where my (potential) misconception actually is ;-) Cheers, Thomas > thanks >

1 0

bwadv vs bwhist + implications
by torhoste＠tor.host-ed.me 19 Sep '12

19 Sep '12

Hi, we're currently looking forward to expand our contribution to the Tor network and as a mathematically fascinated person, I'm pretty much into statistical data from https://metrics.torproject.org/network.html at the moment and implication on Accounting/Bandwidthrate configuration opportunities for our Tor relays to utilize them at maximum efficiency, i.e. I'd like to start a discussion with other relay operators. That said, I noticed that the BW advertised into the network (bwadv) vs the BW actually put through the network (bwhist) is at a 1.544945508 ratio throughout the whole Tor network. I.e. a relay configured to provide 500 GiB of traffic/mo would put through (respectively actually is putting through right now) "just" 323.63601 GiB traffic/mo on average. Now, my questions (respectively thoughts for discussion) would be: 1. What would you assume to be the reason for it? I mean this is a calculated average through 3117 relays and thus I'd say rather meaningful, i.e. the largest possible "sample" (i.e. it isn't just a few relays behaving like so). Also, looking at one of our own two test relays that is *definitely* running 24/7 - vks24949, it pretty much shows the same figures. Vnstat estimates 342.23 GiB traffic/mo for September 12 and the relay actually is configured to provide 500 GiB traffic/mo with daily accounting set up (1.461005756 ratio vs 1.544945508 ratio calculated from *.csv provided at https://metrics.torproject.org/network.html for the whole Tor network). 2. As a result of all that, I currently come to the conclusion that it could be a good practice to actually configure 1.544945508 times the traffic for both the daily accountingmax + the actual relaybandwidthrate in KiB/s to *really* utilize the BW provided by sponsors (in our very case) to the full potential. I'm looking forward to your input on this. Thanks in advance, Thomas

1 0

Need advice on IPv6 bridge config
by Steve Snyder 19 Sep '12

19 Sep '12

I'm getting my feet wet with IPv6 bridges, so far without success. I set up a test bridge (0.2.3.22-rc) on one network and plugged the address:port into Vidalia (TBB x86_64-2.2.39-1) on another. The bridge config looks like this in part (local IPv4 address hidden): Address aa.bb.cc.dd OutboundBindAddress aa.bb.cc.dd ORPort [2a00:1d70:ed15:37:235:53:64:0]:443 At run time the final Tor log entries are: [notice] Tor has successfully opened a circuit. Looks like client functionality is working. [notice] Bootstrapped 100%: Done. In Vidalia the message log entries are: [Notice] Learned fingerprint 24432B99CA2533BC95ABF66C7AFE835F96DD2B2D for bridge 2a00:1d70:ed15:37:235:53:64:0:443 [Notice] no known bridge descriptors running yet; stalling That last line is repeated periodically forever. So I have enough connectivity to correctly determine the fingerprint, bit not enough to get bridge descriptors. What am I doing wrong? Thanks.

2 7

Goodbye list
by Dude 18 Sep '12

18 Sep '12

thanks

1 0

Bad exit
by grarpamp 17 Sep '12

17 Sep '12

Exit (one of these two I think, no guarantees): 109C56AC68DB55D16E79F832E19313E6C3E47363 67FD1D03F922975269F94EC7E4FD38C6D0E5E900 - torservers? It's not occurring now via them, but whatever exit it was generated these... Error: mail.google.com uses an invalid security certificate. The certificate is only valid for the following names: *.mywebdav.de , mywebdav.de (Error code: ssl_error_bad_cert_domain) Erroneous public key presented: aa 94 04 12 c4 32 2b c9 62 48 00 88 16 6f cd 8a 21 22 fe 6d 9d 51 63 6f 85 62 db 9c b5 3f e6 bf 1d 45 ca 51 57 3d 5f 83 97 73 b6 dd 99 86 d8 27 e5 07 71 94 cf d5 a4 92 a6 25 f8 06 fd 50 6c ad 70 2c 71 ca 66 38 1d 35 93 f1 c3 ff 52 6a 90 3d 54 fd 6f 69 34 9f 59 29 aa 05 59 91 95 33 53 8b e6 b6 cf 65 dc 02 1a 31 57 d8 f4 11 70 f5 68 46 13 af c1 dc f0 b0 ce 43 b3 13 61 8a 18 00 84 32 2b 9a 9c aa 49 f3 fc b6 a1 d2 a9 d9 bd b4 53 a0 60 46 e7 e9 22 9d 23 08 5c 91 32 89 e7 85 4e ec 18 b7 d0 b3 6b 74 fa b4 f3 08 11 1f 1b e1 55 e9 7b 90 f4 64 93 08 a2 58 70 e0 c6 41 f9 f9 d0 9c b1 3d e9 b6 ae b3 73 ac 11 d3 f6 91 9e 79 f2 b4 d7 7d 96 8a 83 30 b1 bf 40 6f 18 24 42 43 b7 b1 65 7e 3d 1f d2 47 e9 fb 2e 10 21 7c ce 20 a8 c3 35 f3 d8 91 d1 a6 a1 87 52 4b de 39 1e ec b9 4d

4 3

Exit on Brasil
by guerra＠riseup.net 17 Sep '12

17 Sep '12

It has come to my attention this information on lorea's group at n-1.cc: n-1.cc/mod/threaded_forums/topicposts.php?topic=1396718&group_guid=489432 I am sorry if I am double posting, I just wanted to know how much bandwidth it is needed for this project to make sure I am able to contribute.

1 0