- tor-relays - lists.torproject.org

Tor exit node companion
by Eran Sandler 17 Nov '15

17 Nov '15

Hi guys, I had a thought about writing a small Tor exit node companion app. This would be a single executable that does 2 things: - Serve HTTP port 80 traffic on a specific host name and show the standard Tor web page for exit nodes - Serve port 25 (SMTP) and forwards abuse(a)mydomain.com to an address of your choosing Bonus points would be to make sure the HTTP requests serve the latest version of the Tor disclaimer page (so it will automatically take the latest and periodically check that its the latest). It will then replace the various parts (email of the operator etc). I can write it in Go so that its a single rather small executable so that the exit node will only need to run it instead of web server (nginx or something lighter) and an SMTP server (for those pesky automated posts that, like in the case of webiron, are also sent to abuse(a)mydomain.com based on the reserve DNS). Do you think it would be useful? I would sure be happy to run as little processes as possible. Eran

3 4

webiron requesting to block several /24 subnet
by yl 16 Nov '15

16 Nov '15

Hello, I received an abuse email today from my hoster (several emails from webiron in one email), typical automated abuse emails, not much information. However, they request, if the origin IP is a Tor exit, to block the full /24 subnet. As they also state, they will not provide the full IP of there customer and request to block the exit to the /24. Any thoughts on this? I don't like to block the whole /24, just because one idiot using one of the IPs is using some snake oil service like webiron, the collateral damage is to big in my eyes. All other IPs in the same range will be blocked as well. Why should I even care about blocking such IPs given by webiron? In my opinion the blocking is useless from my side and in the worst case the users of webiron will block my exit node IP. Would it be better for the tor network if I'd block the IPs? Is there any bad consequences if I don't for the Tor network? Let me know your thoughts. The services URL is https://www.webiron.com, don't need to go there, I didn't because such services are just useless. Better use fail2ban or something similar. Greeting yl

12 16

Limiting Bandwidth
by Billy Humphreys 11 Nov '15

11 Nov '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hi all, does anyone know how to make a tor relay only use x bandwidth, then stop? I have a 1100GB/month max limit (100GB free) and I don't want it automatically suspending. Any ideas? Regards, Billy. -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCAAGBQJWQ8hDAAoJECGBE+89M6jOfSkQAJk/WtNbHWtDNZ+uBRVr6aCA 89OQ0xudFzz8oxWYkvgnEiSJFdHy+I5tzVVMjVGGl2dXOWN1QB4irWXkQ0xtE5bi 8t27YsWCNT71CMvvBhbeVEU8KMTwnRaW/pnpdbSY3082DljORLpioK+N4R3fyyXR F6xFmPZQtw4X2SruZNZX3TzPjgKuL7p3VTE6WEP9t/A0G3zX+yNi7A5jNSpwVak2 TMMlvQglgoM5TY/HHInXHS4tNPIBhORGNJoGw2mf+fFk6O/LgOnfNRt4FjaHZqBO NNQKtNicaJgqR5hC7+xojog/3quB7WvvqDtzfoJa3VGqtILMM7y3MKx0R81DzZ3l zOsUguYDpjUkxqd/QWdwtmzMeDB5yjh91QCFFfdR56D6bIedWjubYBLUDEXHchSH bstdWTD5ZAePYFgp//hnH2gX5D8X/cC1Kho0S8FLf9uuKKI4Bdmt0UaPmZW8rn2M nf6zIQB7vPLWY/RbA2/tJq1TB2w1JDMtn911uheCrX6H3OiTXLrxTjBz3yTyCzYM Oag6Jpv/991Ir56cBzS8jOHi7Vxr56QuW2S/Cgae8yewJy4St7ISah19dtIU1PGB 66rwK2MmQJ3DynhMqfkompsQNfvugXiC+KXqGoQH2zwAcI0vnsJAn4efpGLaoVcN V2Jcy26OnSvFlBLI3GVx =k9GQ -----END PGP SIGNATURE-----

3 3

TorFlow
by Kenneth Freeman 11 Nov '15

11 Nov '15

A gorgeous visualization of the Tor's data traffic. Feast your eyes! https://torflow.uncharted.software/

5 9

graphing 3 months of onionoo data (2015-08-01 - 2015-10-31)
by nusenu 10 Nov '15

10 Nov '15

Hi, here are a few graphs, that - unlike metrics.tpo - do not focus on relay count but consider CW fraction or exit/guard probabilities. OS share by CW fraction https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… I didn't known about Tor 0.2.8 until I saw this graph https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… ONLINE SAS taking over OVH SAS's position on the AS marked? https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… France hosts 1/3 of the network's guard capacity https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn… and has become the biggest country when it comes to exit probability as well: https://raw.githubusercontent.com/nusenu/tor-network-observations/master/pn…

1 1

Is this bridge worth running?
by eliaz 10 Nov '15

10 Nov '15

I'm running a bridge in Tor Browser 5.0.4 on Win7x86; torrc is fine, and I'm connecting to circuits. However my mean written/read bandwidth is reported in globe to be in the hundreds/tens range. The advertised bandwidth also jumps around, from about 10 to 51 kB/s. And a previous run over five months of continuous running the written/read bytes reached 7K only once. Is this data telling me that the bridge is not carrying much traffic at all? Is there anything I can do to improve performance? And is there any way that I can get some idea of the actual traffic load?- eliaz

1 0

Exit relay seized by police
by Kevin Beranek 10 Nov '15

10 Nov '15

Is there a procedure I should follow if a relay has been seized by the police? Do DirAuths typically do something in cases where a relay is seized? I just got a message from NQHost stating that "We have received several police inquires and court order to seize your VPS. ". This affects relay A1E0245862C707F977DF0EC79257C49CD5DA99FE. Thanks, Kevin

10 21

interpreting extra-infos
by eliaz 09 Nov '15

09 Nov '15

Can anyone point me to a tutorial about how to read the extra-info output of CollecTor? I'm particularly interested in what bridge-ip-versions v4=0,v6=0 means and why bridge-ip-transports does not report the the pluggable transport proxies (obfs3, obfs4, etc.) for the bridge I'm running.

2 1

Wrong IP from faravahar again
by Pascal Terjan 09 Nov '15

09 Nov '15

Nov 04 17:06:00.000 [notice] Our IP Address has changed from 149.18.2.82 to 154.35.32.5; rebuilding descriptor (source: 154.35.175.225). Nov 04 17:08:55.000 [notice] Our IP Address has changed from 154.35.32.5 to 149.18.2.82; rebuilding descriptor (source: 154.35.175.225). 5.32.35.154.in-addr.arpa domain name pointer faravahar.rabbani.jp.

2 1

Faravahar messing with my IP address
by Logforme 09 Nov '15

09 Nov '15

I run the relay Logforme (855BC2DABE24C861CD887DB9B2E950424B49FC34) Saw this in yesterday's log file: Oct 22 03:17:55.000 [notice] Our IP Address has changed from 84.219.173.60 to 154.35.32.5; rebuilding descriptor (source: 154.35.175.225). Oct 22 03:17:55.000 [notice] Self-testing indicates your ORPort is reachable from the outside. Excellent. Publishing server descriptor. Oct 22 03:17:56.000 [notice] Performing bandwidth self-test...done. Oct 22 03:26:55.000 [notice] Our IP Address has changed from 154.35.32.5 to 84.219.173.60; rebuilding descriptor (source: 194.109.206.212). 84.219.173.60: <- My real IP address 154.35.32.5: faravahar.rabbani.jp <- No idea 154.35.175.225: faravahar.redteam.net <- Authority server 194.109.206.212: tor.dizum.com <- Better authority server So if I read it right my relay asked the authority server Faravahar what my IP address is and got the wrong answer. 9 minutes later my relay asked another authority server and got the right answer. My relay show an uptime starting from this time and if the relay did a full restart it meant all the circuits got dropped? Inconvenient for users. My relay have "restarted" like this a few times the last weeks (only Tor daemon "restarting", not the machine). Don't know if Faravahar is behind the other "restarts". This time I just caught it in the log file before it got archived. Is this a know issue with Faravahar? If so, should it be fixed?

7 7