- tor-relays - lists.torproject.org

Sustained large spike in outbound traffic - what might be going on?
by David Tomic 29 Dec '15

29 Dec '15

Hello everyone, I noticed something a little bit "odd" on one of my exit relays recently, and I just wanted to ask whether anybody might be able to account for what was actually happening, and whether it's likely to warrant any further investigation? TLDR; I noticed a fairly significant spike - in excess of 30MB/s (yes, megabytes) - of outbound traffic compared to inbound. http://s2.postimg.org/cvfzqvrsp/graph.png It persisted steadily for just over an hour, until I noticed what was going on and restarted Tor (not the whole server, only Tor), at which point my traffic appeared to return to normal again. I have this relay running a a dedicated machine, with multiple physical NICs, and the ONLY thing which should be touching this NIC is my Tor traffic. Thoughts?

4 6

firefox display issue at https://globe.torproject.org
by Toralf Förster 21 Dec '15

21 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 This is the second time in a row that I suddenly can't see any longer anything on that side using my current ff profile. With an emptied/new profile it works well. B/c it happens now again I do wonder about the culprit. - -- Toralf, pgp: C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlZ4Zy8ACgkQxOrN3gB26U418AD/ZXdK/zMvVpJZuAnGeUOlbiKh fk6JTrg/Kfdlnzd3N1EBAI7YERw1W6dG9x5uWR/RQO5Kg4ZhbV8+KvUL4txGnAnE =2DqN -----END PGP SIGNATURE-----

1 0

Very unbalanced inbound/outbound connections
by Jannis Wiese 21 Dec '15

21 Dec '15

Hi operators, for a couple of days, I see a little bit more than twice as much inbound than outbound connections on my (non-exit, non-guard) relay [0]. I have no real concern about this but I want to explain it to myself somehow. As my relay has the HSDir flag, I started looking at the statistics: The graph for relays with HSDir flags went down by approx. 500 relays in the past days [1], but that’s pretty much traceable to a lot of relays updating from Tor 0.2.6.x to 0.2.7.x (there’s a similar behaviour around Nov 23rd [2] where the updates started as well as around June 08th [3] where updates from 0.2.5.x to 0.2.6.x started). On the other hand, the number of HSDir flags was fluctuating quite a lot looking at the year up to now [4] which never had this effect on my relay. After all, looking at the graphs in atlas (as well in arm) shows no significant (= something like twice as much) difference between the inbound and outbound traffic - so I’m scratching my head now. Another open question would be if HSDir connections are considered as in- or outbound. Up to now, I held the HSDir flag responsible for the slightly higher outbound traffic… So, again: Still no real concern from my side (as my relay is running fine - if it would be an attack, I would be able to feel that, right?), but I would like to understand what’s going on. :-) Maybe one of you here has an idea about this or experienced something similar. To all of you an early “happy holidays”! Cheers, Jannis [0] https://atlas.torproject.org/#details/8827944C4BDCBDAC9079803F47823403C11A9… [1] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=2015-… [2] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=2015-… [3] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=2015-… [4] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=2015-…

2 2

Allow user to provide feedback?
by Eric Hocking 21 Dec '15

21 Dec '15

Would it be possible for there to be a way for users to provide feedback on the current tor relay/server they are using? Ex: users submit feedback such as let's say "relay is slow" when another user uses the proxy, they could see the user provided feedback of the relay

2 1

IPv6 Only Exit Node
by Hans Wurscht 20 Dec '15

20 Dec '15

Hi I would like to operate an IPv6 only exit node. I.e. it's fine if tor relays through IPv4, but I want exiting traffic only through IPv6 (because I don't want my (only) IPv4 to be blocked, abused and such). The way I thought this would work is with the ExitPolicy set as below. But atlas says my IPv6 Exit Policy Summary would be "ExitPolicy reject *:*". Now I'm wondering if my ExitPolicy is wrong defined or if that's a bug of some kind. I'm running Tor v0.2.7.5 (git-6184c873e90d93b2) on Linux with Libevent 2.0.21-stable, OpenSSL 1.0.1k and Zlib 1.2.8. # No IPv4 exit, no exit to my own subnet, no exit to private network, no exit to link local ExitPolicy reject6 [2A02:168:4A06::]/42:* # Block my subnet ExitPolicy reject6 [FC00::]/7:* # Block private IPv6 ExitPolicy reject6 [FE80::]/10:* # Block link-local IPv6 ExitPolicy reject6 [2002::]/16:* # Block 6to4 addresses ExitPolicy reject6 *:25 # SMTP ExitPolicy reject6 *:119 # NNTP ExitPolicy reject6 *:135-139 # NetBIOS ExitPolicy reject6 *:445 # Microsoft AD ExitPolicy reject6 *:563 # NNTP over TLS ExitPolicy reject6 *:1214 # Kazaa ExitPolicy reject6 *:4661-4666 # ? ExitPolicy reject6 *:6346-6429 # Gnutella ExitPolicy reject6 *:6699 # WinMX ExitPolicy reject6 *:6881-6999 # BitTorrent ExitPolicy accept6 *:* # All else ExitPolicy reject private:* # Block private IPv4 ExitPolicy reject *:* # Block all IPv4 ## If set, and we are an exit node, allow client to use us for IPv6 traffic IPv6Exit 1 -- tor.x2a.ch | https://atlas.torproject.org/#details/6FAAD7CC7EBB008AEF2E5AE1BB9082CD8BD60…

4 4

expected IPv6 traffic for an exit relay
by Toralf Förster 20 Dec '15

20 Dec '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I opened my exit for IPv6 after Moritz encouraged us to do so here at this list. I do observe a traffic of 1-2 GB. for IPv6, IPv4 is always abound 300 GB/day. The exit is configure for 8 MB/sec throughgput (==20 TB/month). I do wonder, what are expected values for IPv6. Furthermore between 11th of August and 25th of September I observed a traffic of about 30-40 GB per day for IPv6 - but why only in this time frame ? - -- Toralf, pgp: C4EACDDE 0076E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlZsQtUACgkQxOrN3gB26U6q3QD/X8RceaLv8uKKcUtcO1CbugCK f2nu+JG8xBVJe+kBFCYA/jSddQ7auahsc5YSmuqgJY1fzWu43xN5kWvGG89tyzxe =/91J -----END PGP SIGNATURE-----

2 3

Re: [tor-relays] Opt-In Trial: Fallback Directory Mirrors
by Raul Fournier 18 Dec '15

18 Dec '15

Feel free to opt-in my relay wagner 5525D0429BFE5DC4F1B0E9DE47A4CFA169661E33

1 0

I relay subscription
by David Smith 17 Dec '15

17 Dec '15

1 0

Re: [tor-relays] Webiron at it again...
by Juuso Lapinlampi 17 Dec '15

17 Dec '15

Bruteforce attacks generate a lot of traffic, so Webiron gets an excuse to blame the Tor network as a major source of abuse versus "regular" traffic. > "Tor: Please note as the abuse from Tor has gotten out of hand, we do > not give free passes to abuse coming from Tor exits. See the leader > board linked below for more details on the issue." We received this too. Quite oddly though, after sending them 6 or 7 email acknowledgements that our Tor exit IP-address is a Tor exit (duh), they have stopped sending us abuse complaints. Maybe we got a free pass after all, although I didn't request one. And yeah, Webiron's not to be taken very seriously.[1] I've lost their credibility a long time ago when they exclaimed that Tor exit operators would be held legally liable for the routed traffic - of course not. It's called fear mongering. -Wub [1]: https://lists.torproject.org/pipermail/tor-relays/2015-December/008259.html

1 0

ornetradar notifications from 2015-12-15
by nusenu 16 Dec '15

16 Dec '15

say hi to a bunch of new AWS servers http://article.gmane.org/gmane.network.onion-routing.ornetradar/738 subgroups: nickprefix: torpr http://article.gmane.org/gmane.network.onion-routing.ornetradar/736 Nickprefix: Willy http://article.gmane.org/gmane.network.onion-routing.ornetradar/739

1 0