- tor-relays - lists.torproject.org

BoingBoing: What happened when we got subpoenaed over our Tor exit node
by starlight.2015q3＠binnacle.cx 08 Aug '15

08 Aug '15

http://boingboing.net/2015/08/04/what-happened-when-the-fbi-sub.html check out comment #2 as well as the blog article

4 3

Re: [tor-relays] Guard flag flapping
by torrry＠Safe-mail.net 08 Aug '15

08 Aug '15

-------- Original Message -------- From: starlight.2015q3(a)binnacle.cx Apparently from: tor-relays-bounces(a)lists.torproject.org To: tor-relays(a)lists.torproject.org Subject: [tor-relays] Guard flag flapping Date: Sat, 08 Aug 2015 14:39:48 -0400 > My advice is that this QWest service is third-rate > and rather than bleeding for the length of the > contract, run for the hills! > > If you are still in the 1-month cancellation > period (relays are about a month old), terminate > the service immediately and place an order for > Verizon FiOS. Verizon is one of those ISPs who have played routing games, slowing down Netflix and other traffic that happens to use use the same routing: http://www.extremetech.com/computing/186576-verizon-caught-throttling-netfl…

1 0

Guard flag flapping
by starlight.2015q3＠binnacle.cx 08 Aug '15

08 Aug '15

[apologies to all for thread-breaking, am really going on hiatus but the horror-show performance GBE topic was too darn interesting--last post I promise!] >I would call it a dedicated gigabit link. This is >probably up for debate. The provider's overall >capacity is very likely not [number of customers] >x [1 Gb/s] but I've never witnessed signs of >throttling or over-subscription. Pulling a whois on the IP 184.100.166.110 and a quick Google turned up that you are probably a bleeding-edge subscriber to this new Quest service: https://www.centurylink.com/fiber/ Running a filter on Blutmagie hostname contains quest shows that your relays are, by a huge margin, the fastest of about a dozen. My advice is that this QWest service is third-rate and rather than bleeding for the length of the contract, run for the hills! If you are still in the 1-month cancellation period (relays are about a month old), terminate the service immediately and place an order for Verizon FiOS. FiOS costs more, but sells real bandwidth instead of imaginary bandwidth. You can run a relay on a 75/75 MBit link (like mine) and obtain respectable bandwidth ranking. FiOS goes up to 1/2 GB for about $300-400 per month but the bandwidth is real and the network is good-to-excellent. Either that or switch to leasing a colo server in Germany or some other country where bandwidth is extremely cheap, or perhaps finding a cheap bandwidth colo in the US. QWest GBE looks like a turkey.

1 0

Guard flag flapping
by starlight.2015q3＠binnacle.cx 08 Aug '15

08 Aug '15

>The problem is likely that your ISP is routing >some traffic via an overloaded peering point. Running traceroute -w 1 -q 5 -A <bwauth-IP> 1400 may provide more detail on this issue. The -A option causes 'traceroute' to show Autonomous System numbers with each route hop, where ASNs are Internet routing domains associated with different network providers. One can readily see where big increases in latency are occurring along the path and what peerings are associated with it. Note that some big increases are justified--such as with a hop over a transatlantic cable. Setting -q 5 (or bigger) causes traceroute to attempt each hop that many times. If you see asterisk characters, that's packet loss and may indicate congestion points. Setting the packet size to 1400 will increase the probability that network congestion will impact the results. Try pulling up https: // torstatus dot blutmagie dot de which shows IPs together with other relay attributes and experiment tracing to various major relays.

1 0

Guard flag flapping
by starlight.2015q3＠binnacle.cx 08 Aug '15

08 Aug '15

>. . .have physical access to the . . . ONT. > Doubt this is the case, but on the off chance that the ONT is configured to flow IP traffic over a coaxial cable attached to a CPE router (customer premise equipment), the configuration should be changed to deliver data over a Gigabit Ethernet directly to a good-quality GBE switch provided by you. New eight-port Netgears are surprisingly good managed switches for around $100. For under $600 you can purchase used 24-or-48-port Nortel/Avaya 5510/5520 switches on eBay. Though old, these enterprise grade switches have astounding performance characteristics due to the Broadcom silicon switch-fabric chipset. Were around $7000 new when they were current-gen. All above switches have VLAN support so one switch can operate as multiple isolated networks. I run a Verizon FiOS 75/75 and the default setup is for Internet traffic to pass to a Verizon supplied Actiontec router over a coax cable. Fortunately I hung out with the installer and found out up front--had it switched to the GBE from the outset. For any VZ customers reading this, note that you can connect the Actiontec to your network so it can obtain TV programming information. The coax will continue to carry video and phone data which are on separate fiber optic wavelengths/channels.

1 0

onionoo.thecthulhu.com: 500 Server Error
by nusenu 08 Aug '15

08 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi Thomas, in case this is not known to you yet: There appears to be a problem with your onionoo instance: https://onionoo.thecthulhu.com/summary?limit=1 Error 500 Server Error -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVxZ6AAAoJEFv7XvVCELh05cUQALASqTfj6gZTb8gd73WT/9mB gcUHqhl6scGBNW9Vl88X0uAk55HdO36nqOc/rTv9GaMSFQQ1bgO1nUIFWTvDcpNG /yLTHwWOshoaVNLmL6kJV4KiaLDtUjA3jY8knh59mIYBjL6gLaIKjp8c55i4HUzM UmYa9vPVVOmdWhAuIoIImbEfQqRcR61Ig0NBGheYWF7AAPBgQUv9c+c4fCYOBnla hs9pEMQJ/5u860RJqfETbEe/JVwD3zD+gJL9S7tshQNWKFAShPElgVMRvPu0aRK2 7IIG4szdinqXKd/7Ii9ZtllhWGu9vDGYeFP+9U/sHg4RGZ7bJhLwsMd5VTOgLGpb b5IEPxfTxfSN27FJig+bj6NNCtsVEmYKFayeWhAbml2Rip60a9fc+OBd9tGP6jlb pGCtox02kVUt+7zFJv1sqdf3Qp05RwvETr0it5d0V2+Lm68MRfVZDZ7O24IOTaYp eG6gBMnkmL2hNbgNgUMlvqOOiLYOyjlzhJx1toFLJcdWm9yfSTn90DrfaDFzMacF RRa7oW/mCzo0vseYhTWKJO8w4HJZJUbumZ0w11liqJbJQc1bg4nSVHurVf88Fb6H 5E80IsSFqNA1/vp15tTQsuAkTCK/ycLkKpPYd4Sz8ZEGiKXVqCNszG0QX8MCgk9Q QHz0wwggcg9wGiHFG13l =9H2Z -----END PGP SIGNATURE-----

2 2

Guard flag flapping
by starlight.2015q3＠binnacle.cx 08 Aug '15

08 Aug '15

>I had already run tests with both speedtest-cli >and iperf3. This server consistently achieves 200 >to 300 Mb/s in both directions, with both relays >still running, and on some runs is hitting over >800 Mb/s. Final caveats: If the server is on a shared gigabit link, performance may not improve. The difference between a dedicated gigabit and a shared gigabit is immense. One expects an ISP to load a shared GB links as heavily as possible--I.E. up to the point where customers complain and terminate service. True dedicated gigabit links are expensive. If it's running in a VPS that's showing a gigabit link speed, the number is fiction.

2 1

Guard flag flapping
by starlight.2015q3＠binnacle.cx 07 Aug '15

07 Aug '15

One more errata: The sense of this is negative, so the current setting you have is correct: net.ipv4.tcp_no_metrics_save = 0 The double-negative got me.

1 0

Guard flag flapping
by starlight.2015q3＠binnacle.cx 07 Aug '15

07 Aug '15

comments backward, but the sysctls are correct * 25 milliseconds or 3125000 (for write) * 40 milliseconds or 5000000 (for read)

1 0

Guard flag flapping
by starlight.2015q3＠binnacle.cx 07 Aug '15

07 Aug '15

Ah, forgot to calculate the default TCP windows for you link speed rather than mine. So that's 125000000 bytes/sec ( 1 gigabit / sec ) * 25 milliseconds or 3125000 (for read) * 40 milliseconds or 5000000 (for write) net.core.rmem_max = 16777216 net.core.wmem_max = 16777216 net.ipv4.tcp_wmem = 4096 3125000 16777216 net.ipv4.tcp_rmem = 4096 5000000 16777216 The 25 and 40 milliseconds are my guess at roughly the faster and more middle ping times within the domestic US Internet. This just gets each connection started net.ipv4.tcp_moderate_rcvbuf = 1 net.ipv4.tcp_timestamps = 1 cause the IP stack to very quickly establish precise values for the transmit and receive TCP windows.

1 0