- tor-relays - lists.torproject.org

Bandwidth Accounting troubles
by Tyler Johnson 02 Apr '17

02 Apr '17

Hello! I've enabled bandwidth accounting on my tor relay, but encountering issues when the relay attempts to wake from hibernation.... Mar 20 23:47:25 tcj Tor[74346]: Bandwidth soft limit reached; commencing hibernation. No new connections will be accepted Mar 20 23:52:30 tcj Tor[74346]: Heartbeat: Tor's uptime is 10 days 12:00 hours, with 150 circuits open. I've sent 90.20 GB and received 90.30 GB. We are currently hibernating. Mar 20 23:52:30 tcj Tor[74346]: Circuit handshake stats since last time: 2745/2745 TAP, 15557/15557 NTor. Mar 20 23:52:30 tcj Tor[74346]: Since startup, we have initiated 0 v1 connections, 0 v2 connections, 0 v3 connections, and 113565 v4 connections; and received 1100 v1 connections,130 v2 connections, 41 v3 connections, and 249967 v4 connections. Mar 21 00:00:00 tcj Tor[74346]: Configured hibernation. This interval began at 2017-03-21 00:00:00; the scheduled wake-up time was 2017-03-21 00:00:00; we expect to exhaust our quota for this interval around 2017-03-22 00:00:00; the next interval begins at 2017-03-22 00:00:00 (all times local) Mar 21 00:00:00 tcj Tor[74346]: Hibernation period ended. Resuming normal activity. Mar 21 00:00:00 tcj Tor[74346]: Opening OR listener on 185.92.223.3:8080 Mar 21 00:00:00 tcj Tor[74346]: Could not bind to 185.92.223.3:8080: Address already in use. Is Tor already running? Mar 21 00:01:00 tcj Tor[74346]: Opening OR listener on 185.92.223.3:8080 Mar 21 00:01:00 tcj Tor[74346]: Could not bind to 185.92.223.3:8080: Address already in use. Is Tor already running? Mar 21 00:02:01 tcj Tor[74346]: Opening OR listener on 185.92.223.3:8080 Mar 21 00:02:01 tcj Tor[74346]: Could not bind to 185.92.223.3:8080: Address already in use. Is Tor already running? It will continue in this manner until I manually intervene and restart the relay instance. snippet from torrc: ## Set a maximum of 30 gigabytes each way per period. AccountingMax 30 GBytes ## Each period starts daily at midnight (AccountingMax is per day) AccountingStart day 00:00 ## Required: what port to advertise for incoming Tor connections. ORPort 185.92.223.3:8080 ## The IP address or full DNS name for incoming connections to your ## relay. Leave commented out and Tor will guess. Address 185.92.223.3 ## If you have multiple network interfaces, you can specify one for ## outgoing traffic to use. OutboundBindAddress 185.92.223.3 Tor version and OS: $ tor --version Tor version 0.2.9.10 (git-1f6c8eda0073f464). $ uname -a OpenBSD tcj.me 6.1 GENERIC#224 amd64 Has anyone else experienced this issue? I have only one outbound interface, so is setting the OutboundBindAddress unnecessary and possibly causing the problem? I do apologize if this has been discussed already. Please point me to the relevant post if so! Thanks in advance, Tyler

2 4

22% of bridges run by a single entity?
by nusenu 30 Mar '17

30 Mar '17

Hi, is it known that (likely) a single entity is running ~22% of all bridges? (not the 'ki' bridges [1]) I'm not necessarily saying that this is bad, just curious and wondering if this is somehow known. Since contactinfo is removed from bridge descriptors before publication I can not tell whether this is i.e. torservers, Frenn vun der Enn, AccessNow, ... Added on [2] 2016-01-17 2016-01-18 2016-01-24 [1] https://lists.torproject.org/pipermail/tor-project/2016-December/000851.html [2] https://github.com/nusenu/tor-network-observations/blob/master/bridges_adde…

5 6

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Great. On Mar 29, 2017, at 01:03, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Sure do . From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 11:02 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Sir, I do not know why you contacted me. You did not tell me what was attacked, when it was attacked, or how it was attacked. Now you're threatening to attack me. Clearly, you are not a reasonable person. Do what you must. My information is public, you know where I live and you have my telephone number. :-) John On Mar 29, 2017, at 00:57, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Look pal, CC me again to your dark webbers and I will go after you. I clearly contacted you about a complaint for hackers coming from YOUR servers. I copied and pasted it right to you. Don't play games, "doc". Complaints: 1) Hackers are coming from your servers. 2) You're sharing my information with a large email list without my permission about hackers coming from your servers, for contacting you about these very same hackers. Don't play stupid. You know exactly why I contacted you.

3 3

(no subject)
by Nicholas K S Cullen 29 Mar '17

29 Mar '17

Please.unsubscribe me

2 2

(no subject)
by Nicholas K S Cullen 29 Mar '17

29 Mar '17

Please unsubscribe me

1 0

Recent events in Tor-Relay.
by John Ricketts 29 Mar '17

29 Mar '17

All, Any suggestions short of a restraining order? That was one of the most bizarre interactions I have ever had with anyone on the internet. Thanks for your input, John

2 2

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Sir, I do not know why you contacted me. You did not tell me what was attacked, when it was attacked, or how it was attacked. Now you're threatening to attack me. Clearly, you are not a reasonable person. Do what you must. My information is public, you know where I live and you have my telephone number. :-) John On Mar 29, 2017, at 00:57, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Look pal, CC me again to your dark webbers and I will go after you. I clearly contacted you about a complaint for hackers coming from YOUR servers. I copied and pasted it right to you. Don't play games, "doc". Complaints: 1) Hackers are coming from your servers. 2) You're sharing my information with a large email list without my permission about hackers coming from your servers, for contacting you about these very same hackers. Don't play stupid. You know exactly why I contacted you.

1 0

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, I am sorry you feel attacked. Feel free to take whatever action your require. Let's start with the actual issue, you did not outline any actual abuse complaint. Please detail your issues, and I will explain to you how to block Tor traffic and specifically my IP addresses since you feel the source is Quintex. Until you send me a valid abuse complaint with actionable information, there is nothing further I can do to assist you. John On Mar 29, 2017, at 00:47, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Now the abuse is sharing my info was a bunch of dark web hackers for contacting an ISP about abuse. That’s sick. Now I do have cause. From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 10:46 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, I am sharing this discussion with everyone as I have nothing to hide and I feel this is of the public interest. I am very familiar with Tor's origins, original intent and what it is used for today and where it's future hopefully will go. Thank you taking the time to email me with your abuse complaint. If you have any further issues, please feel to email me. In the future please please include more technical details such as IP addresses, the specific attack and times and dates. Sincerely, John L. Ricketts, PhD Quintex Alliance Consulting On Mar 29, 2017, at 00:41, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: I know quite a lot about Tor and how it was developed by the Navy and is used by agents for covert work. Maybe you should study more about Tor. You’re not as discrete as you think. Why are you CCing me to the entire Tor email list? Was I talking to them, or you? From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 10:38 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, Please read https://torproject.org and perhaps you'll change your mind. Bad people will do bad things no matter what. If a bank robber uses a public street or highway during a crime does that mean we should destroy the highway? No. I wish you the best. John On Mar 29, 2017, at 00:28, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Thanks for the info. You’re still an IP providing frauds, pedophiles, and intelligence agencies access to do illegal attacks and activities. Bunch of cowards to hide behind Tor… From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 9:28 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm… Please turn it off or I’ll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, I am sharing this discussion with everyone as I have nothing to hide and I feel this is of the public interest. I am very familiar with Tor's origins, original intent and what it is used for today and where it's future hopefully will go. Thank you taking the time to email me with your abuse complaint. If you have any further issues, please feel to email me. In the future please please include more technical details such as IP addresses, the specific attack and times and dates. Sincerely, John L. Ricketts, PhD Quintex Alliance Consulting On Mar 29, 2017, at 00:41, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: I know quite a lot about Tor and how it was developed by the Navy and is used by agents for covert work. Maybe you should study more about Tor. You’re not as discrete as you think. Why are you CCing me to the entire Tor email list? Was I talking to them, or you? From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 10:38 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, Please read https://torproject.org and perhaps you'll change your mind. Bad people will do bad things no matter what. If a bank robber uses a public street or highway during a crime does that mean we should destroy the highway? No. I wish you the best. John On Mar 29, 2017, at 00:28, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Thanks for the info. You’re still an IP providing frauds, pedophiles, and intelligence agencies access to do illegal attacks and activities. Bunch of cowards to hide behind Tor… From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 9:28 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm… Please turn it off or I’ll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0

Re: [tor-relays] Hackers
by John Ricketts 29 Mar '17

29 Mar '17

Hello, Please read https://torproject.org and perhaps you'll change your mind. Bad people will do bad things no matter what. If a bank robber uses a public street or highway during a crime does that mean we should destroy the highway? No. I wish you the best. John On Mar 29, 2017, at 00:28, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: Thanks for the info. You're still an IP providing frauds, pedophiles, and intelligence agencies access to do illegal attacks and activities. Bunch of cowards to hide behind Tor... From: John Ricketts [mailto:john@quintex.com] Sent: Tuesday, March 28, 2017 9:28 PM To: contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com> Cc: tor-relays(a)lists.torproject.org<mailto:tor-relays@lists.torproject.org> Subject: Re: Hackers Hello, It's because i'm running Tor Exit servers. I am an ISP. I will not turn off any of the Tor exit servers because I am not doing anything illegal. If you feel you must file legal action, please do so. If you're not concerned about blocking Tor, why don't you block all of the exit nodes instead? Bloxking just my exit will not help a lot. Feel free to block 199.249.223.0/24 and 199.249.224.0/24 and you won't have any traffic from Quintex servers. John On Mar 28, 2017, at 22:54, "contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>" <contact(a)gnosticmedia.com<mailto:contact@gnosticmedia.com>> wrote: John, why am I getting Tor related hackers from your servers? Hmmm... Please turn it off or I'll be filing legal against your company. You've chosen to block the network that 199.249.224.41 is part of. We've marked the networks we found that this IP address belongs to in red below. Make sure you read all the WHOIS information so that you see all networks this IP belongs to. We recommend blocking the network with the lowest number of addresses. You may find this is listed at the end as part of the 'rWHOIS' query which contacts the local WHOIS server that is run by the network administrator. # # ARIN WHOIS data and services are subject to the Terms of Use # available at: https://www.arin.net/whois_tou.html # # If you see inaccuracies in the results, please report at # https://www.arin.net/public/whoisinaccuracy/index.xhtml # # # The following results may also be obtained via: # https://whois.arin.net/rest/nets;q=199.249.224.41?showDetails=true&showARIN… # NetRange: 199.249.224.0 - 199.249.224.255 [256 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> CIDR: 199.249.224.0-199.249.225.255 [511 addresses in this network. Click to block this network]<http://www.gnosticmedia.com/wp-admin/admin.php?page=WordfenceBlocking&wfBlo…> NetName: QUINTEX224 NetHandle: NET-199-249-224-0-1 Parent: NET199 (NET-199-0-0-0-0) NetType: Direct Assignment OriginAS: AS7018, AS6939, AS13693, AS3549, AS62744 Organization: Quintex Alliance Consulting (QAC-4) RegDate: 1994-06-02 Updated: 2017-03-13 Ref: https://whois.arin.net/rest/net/NET-199-249-224-0-1 OrgName: Quintex Alliance Consulting OrgId: QAC-4 Address: 308 Bluegrass Drive City: San Angelo StateProv: TX PostalCode: 76903 Country: US RegDate: 1994-06-03 Updated: 2016-08-22 Ref: https://whois.arin.net/rest/org/QAC-4 OrgAbuseHandle: JR125-ARIN OrgAbuseName: Ricketts, John L OrgAbusePhone: +1-325-653-1444 OrgAbuseEmail: john(a)quintex.com<mailto:john@quintex.com> OrgAbuseRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgNOCHandle: JR125-ARIN OrgNOCName: Ricketts, John L OrgNOCPhone: +1-325-653-1444 OrgNOCEmail: john(a)quintex.com<mailto:john@quintex.com> OrgNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN OrgTechHandle: JR125-ARIN OrgTechName: Ricketts, John L OrgTechPhone: +1-325-653-1444 OrgTechEmail: john(a)quintex.com<mailto:john@quintex.com> OrgTechRef: https://whois.arin.net/rest/poc/JR125-ARIN RNOCHandle: JR125-ARIN RNOCName: Ricketts, John L RNOCPhone: +1-325-653-1444 RNOCEmail: john(a)quintex.com<mailto:john@quintex.com> RNOCRef: https://whois.arin.net/rest/poc/JR125-ARIN

1 0