- tor-relays - lists.torproject.org

Guard flag flapping
by starlight.2015q3＠binnacle.cx 07 Aug '15

07 Aug '15

First, I am assuming you are running bare-metal on a system and not in a virtualized server--everything below is premised on that. Do not expect a virtual server or Linux container to perform well as a high- capacity Tor relay. It's possible to configure a high-performance VM, but this is an esoteric art and one is better off renting a small dedicated physical server than going that route. Your story of a relay setup that should measure fast by all apparent metrics but is given terrible rankings by BWauths is common this year. BWauths scripts are known to be buggy, though supposedly have been improved very recently. 'longclaw' just came back online with the "latest" code, but after starting out with a failure to measure 2000 relays two days ago, it's still running 1000 shy of the full population: https://consensus-health.torproject.org/#bwauthstatus Scroll down a little and you will see 'longclaw' is unique in voting 976 relays not-guard and 1709 relays not-fast. That seems a more serious issue than cold start glitching IMO, and is not impressive if that is what it really is. A fifth BWauth is said to be arriving soon and it is said that it will help. Your relays currently are measured thusly: greendream848 longclaw-w Bandwidth=1694 Measured=986 gabelmoo-w Bandwidth=1694 Measured=347 maatuska-w Bandwidth=1694 Measured=874 moria1 -w Bandwidth=1694 Measured=1550 spacequeen974 longclaw-w Bandwidth=1698 Measured=493 gabelmoo-w Bandwidth=1698 Measured=970 maatuska-w Bandwidth=1698 Measured=1930 moria1 -w Bandwidth=1698 Measured=2130 You can see future and past reports of these in https://collector.torproject.org/recent/relay-descriptors/votes/ https://collector.torproject.org/archive/relay-descriptors/votes/ where longclaw is 23D15D9. . . gabelmoo is ED03BB6. . . maatuska is 49015F7. . . moria1 is D586D18. . . That the measurements are all in the same ballpark does indicate that some subtle issue with the network and/or equipment may be at work and the BWauths may not be at fault. But many have complained that nothing they do seems to work. If the firewall is performing stateful packet inspection or any kind of DPI (deep packet inspection) disable that for all incoming and outgoing Tor traffic. It's all encrypted anyway so there's no point, and DPI can drag down performance big-time. The directory traffic is unencrypted but I've never heard of a firewall with stateful rules for the Tor directory protocol. If you can put the system directly on the public IP address with no firewall or local-rack router I recommend doing this. Just make sure iptables are set to protect login and other non-tor access. Either that or disable iptables and strip the server down so that nothing but the 'tor' process and 'ssh' are running, and configure 'ssh' to accept only certificate authentication (be sure to set and test the cert auth before applying the setting). Check for minimized listeners with lsof -Pn | fgrep LISTEN The email daemon should stay up to handle alarms, just be sure it listens on 127.0.0.1. Likewise anything else that is absolutely necessary. Use *Port and *Policy settings in torrc to lock down control and socks access to the daemon. One notable sysctl that matters for high-capacity relays is net.netfilter.nf_conntrack_checksum = 0 though having this enabled would not cause the current poor measurements. You should change this setting: net.ipv4.tcp_no_metrics_save = 1 turning this off was to work around a very- long-ago kernel bug that is fixed everywhere. Turning it on improves performance. You might try net.ipv4.tcp_wmem = 4096 250000 4194304 net.ipv4.tcp_rmem = 4096 375000 4194304 which will cause the congestion window to get to full size a bit quicker, and these net.core.somaxconn = 1024 net.core.netdev_max_backlog = 524288 net.ipv4.tcp_slow_start_after_idle = 0 net.ipv4.tcp_keepalive_time = 600 which increase various limits for fast networks, lots of connections. Make sure these defaults values are active and have not been changed to non-default by /etc/sysctl.conf: net.ipv4.tcp_moderate_rcvbuf = 1 net.ipv4.tcp_timestamps = 1 net.ipv4.tcp_window_scaling = 1 net.ipv4.tcp_sack = 1 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_congestion_control = cubic And try adding TXQUEUELEN=100000 to the /etc/sysconfig/network-scripts/ifcfg-ethX for the interface(s) where tor runs. Manually activated with ip link set qlen 100000 dev ethX ip link show dev ethX Finally make sure the kernel is of a vintage with the Google-advocated connection-start congestion-window increase: https://lwn.net/Articles/427104/ http://samsaffron.com/archive/2012/03/01/why-upgrading-your-linux-kernel-wi… http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdi… If you end up implementing any of the above and it works please describe the results in tor-relays post.

1 0

Guard flag flapping
by starlight.2015q3＠binnacle.cx 07 Aug '15

07 Aug '15

Both relays are showing low BWauth-measured bandwidth and are below the 2000 threshold for the Guard flag. Recently BWauths were offline and the consensus algorithm reverted to self- measure. During that period the relays were above the 2000 threshold and were assigned Guard. But even the self-measure was very low for a gigabit link in a tier-1 network (Quest). Some more tuning work is probably needed to get performance up higher. Possibly network issues are at work. If a low-end consumer-grade router or firewall is in the picture, it could be the cause of the problem.

2 2

Guard flag flapping
by starlight.2015q3＠binnacle.cx 07 Aug '15

07 Aug '15

You might start with running SpeedTest via the Python script to see how the network performance looks: https://pypi.python.org/pypi/speedtest-cli/

1 0

most hibernating relays wake up at the same time
by nusenu 07 Aug '15

07 Aug '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hi, most hibernating relays with daily quotas start relaying traffic at 0:00 local time. The timezone introduces some distribution but most relays are located in UTC +02:00 so most of them start relaying at 22:00 UTC. If you run a hibernating relay and want to spread your resources more evenly you can set a non-default AccountingStart time, simply choose HH:MM in that setting as you wish. (yes, AccountingStart != wakup time, but in practice it is the case for most hibernating relays with daily quotas) If someone has stats on when the tor network needs most bandwidth during the day it might makes sense to set AccountingStart accordingly - - to add bandwidth when most users need it. (but bw doesn't seem to be an issue currently..) Reference: https://trac.torproject.org/projects/tor/ticket/16723 -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVw9GgAAoJEFv7XvVCELh08iEP+wQ0F0+62ktQhR8fCFe+9yLS HacxpzLMG/4jDL0MmimVqCr5Ql9P05CXKzLse7ItEWNn5PlEkZ6z37DlQ9ctNgjY EwMlXZc1z+gLWRtHaWy6Yd0YUWkOfVfRu3bO2QDa5AN1/cEGv6+R8ddm1Ny2Mfem 5zMILOR3tofVNtpyFlahUQDEf2wQuZBMwmpYykD3I2+MfnOoeTe2AXHmgwtMdaNQ +CG+dEp8DueIYINqkYBWzmBZyTjtv3Z/ADHqyUDqFdwEsSWeC54Yb/2fZh1IEJub 383Zvhb4T3LRF2dUvKRFSCzTZl6FqZ4R1W2RvRV2Hg7xXtllbFUC/jY5i7zuJfe0 /aA5ZUv5+Rrqk7uOJpLaf6sXJGJBwCL1W5qDEtoZzQjHxbA8TFBQFYXtEfRUKiXA AiBFaJ+eLJlyztt38B6FxkN8auC25Y8csFtwcj25b8zykN4t+sFbrJvqy9r+dpzC klUlJuAlj3Oljjo4Ppd02k47yxmkc17e3TT5wm6tI2k8ZX7cD4GrK5ely+lxh/iz uceyEb7vphliJwt/slLQl9/wtg8dLvdIrpZ/rRO8uCVubSNodUuoyvuAtWn+xjsp BvwrCL0u6C/tkzRWR6OZPpuepnMk3vil9lNRkKuOadKnr2rihFb6qXgZg0RKpQDu IWCw2pXlUbbycW7K84Go =IYU/ -----END PGP SIGNATURE-----

3 4

Guard flag flapping
by Green Dream 07 Aug '15

07 Aug '15

I have two relays on the same Gb/s connection. I followed the optimization tips offered in another thread, and think I have things running reasonably well. What I don't understand is why the Guard flag keeps flapping back and forth on both relays. https://atlas.torproject.org/#details/89B9AE4C778DE44AFFAB791093E19979616E6… https://atlas.torproject.org/#details/11A579CC6CEE644A390704977B70CBA8D8347… If you look at the 1 week graph of weights, you'll see what I mean. I haven't been able to find any documentation or explanation for this behavior. Anyone have any thoughts on why this might be happening, or any pointers on how to further investigate?

1 0

longclaw BWauth is back, not measuring 2000 relays, what's with that?
by starlight.2015q3＠binnacle.cx 06 Aug '15

06 Aug '15

The explanation does help--thank you. Have been interested in how it would look after the script update since 7/28 (nine days ago) but did not realize it took so long to rebuild the data.

1 0

longclaw BWauth is back, not measuring 2000 relays, what's with that?
by starlight.2015q3＠binnacle.cx 06 Aug '15

06 Aug '15

longclaw 4691 Measured values in w lines maatuska 6815 Measured values in w lines gabelmoo 6347 Measured values in w lines moria1 6715 Measured values in w lines

2 1

BWauth no-consensus state in effect
by starlight.2015q2＠binnacle.cx 06 Aug '15

06 Aug '15

FYI list https://trac.torproject.org/projects/tor/ticket/16696 Description At present both 'longclaw' and 'maatuska' have dropped out of the BW consensus ('longclaw' is restarting with new version, not sure about 'maatuska'). This has caused the BW consensus logic to revert to using relay self-measurement for BW weightings due to fewer than three BW authorities participating. The 10000 cap placed on self-measure values is causing super-fast relays serious demotion and slower relays corresponding promotion in the consensus weighting. Possibly this may result in network unbalance issues. Some adjustment of the logic seems in order.

10 12

Blutmagie does not see 0.2.7.2 bandwidth
by starlight.2015q3＠binnacle.cx 04 Aug '15

04 Aug '15

>At Tue Aug 4 11:22:22 UTC 2015 by Olaf Selke olaf DOT selke at blutmagie DOT de > >by the way... I will probably shut down blutmagie >tor network status in September this year cause >the data center has terminated the contract >housing my servers 10/31/15. Could you make your modified Torstatus code available on https://gitweb.torproject.org/torstatus so that someone else can set up another like it? Blutmagie appears to have significant and desirable enhancements to the code presently in the GIT repository. I might contribute a new Torstatus, but if not me someone surely will.

2 1

BWauth no-consensus state in effect
by starlight.2015q3＠binnacle.cx 04 Aug '15

04 Aug '15

Maybe geo-location would not be so great because two networks in the same physical area might have relatively poor connectivity to each other. Aggregated IP block might be the ticket. CIDR-Report has both actual and suggested netblock aggregations. http://www.cidr-report.org/as2.0/#Gains Shows 562259 reduced to 253420 advertisements. Perhaps too fine-grained, but 250k is not so much bigger than the 45k ASN count. Idea is to anchor metrics to maximum size BGP routable blocks, which ought to correlate performance-wise down to all the IPs in each block. >>BWauths are continuously pairing relays for >>measurements, and perhaps metrics from that >>could be mapped to autonomous system numbers > >. . .scratch AS, geo-location is >better and MaxMind specializes in that > >Pinging a FiOS relay in LA takes >75ms while a close-by relay takes >8ms. Both are in AS 701.

1 0