- tor-relays - lists.torproject.org

guard-failing message
by eliaz 27 Feb '15

27 Feb '15

My bridge's log showed: Feb 24 02:25:45.940 [Warning] Your Guard < guard name and fp > is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 129/259. Use counts are 38/38. 242 circuits completed, 0 were unusable, 113 collapsed, and 5 timed out. For reference, your timeout cutoff is 60 seconds. Globe showed no 3-day chart for the guard. For my bridge, the chart showed a lot of traffic, the peaks or less than a KB. This pattern has been going on for a few days. The bridge usage display shows the usual traffic, but more anemic the past several days. To be on the safe side I did the following: * shut down the bridge, * reset my gateway address, * restarted the bridge after about 1/2 hour. Have I overreacted? - eliaz

1 0

Same relay (identity key) on two IPs
by catchthemall 26 Feb '15

26 Feb '15

Hi all, tl;dr: Due to a config error my relay [1] was running on two different IPs at the same time for about half a day. Now the traffic has dropped. I just wanted to make sure that it is not flagged as malicious or something ... Additionally I am curious about the policy in such a case. What happens if a relay shows up in the network with the same identity key but on different IP addresses? long-version (kinda funny): I am using webtropia [2] as a service provide which is, as far I can tell, is a good choice for running a relay. Some time ago I decided to change the hosting plan and switch to another offer at the same provider. For that reason I let my old contract run out until they notified me that my server will be shut down and deleted. After receiving this notification I checked that indeed my relay server was no longer reachable. Some time passed by until I had time to setup my old relay (same identiy key) on the new server. Done so I launched it and was happy to enjoy the increased bandwidth. What I missed was that in the meantime the old server was reactivated by the hosting provider without notifying me and as a result was running at the same time as the new one for about half a day. After I recognised this, I tried to ssh to the old server - which still worked perfectly and indeed confirmed that everything was as I left it. I shut down the relay running on the old server and wrote an e-mail to the hosting provider checking if they are going to charge me the reactivation and why the hell reactivated it. Up until now I only got an response that my old server was "shut down" and that the "hard disk was deleted on the 29.01.2015" ... .. I thought well ... since I can still ssh to that server I kinda doubt that this is the case. So since I still had ssh access to the "shut down server" I decided to setup another relay on the "deleted hard disk" of this machine until they believe me that there exists a small possibility that this thing is still running ... The "ghost" relay [2] is running fine up until now. [1] https://atlas.torproject.org/#details/5A9B5923F4937C3ED76B0AD4CF1030C11FCAF… [2] http://www.webtropia.com/index.php [3] https://atlas.torproject.org/#details/23C31DBBEB898145D6E090D6DD8C06D72E55F…

3 5

Relay Node not acquiring Guard Flag.
by Sebastian Urbach 24 Feb '15

24 Feb '15

Hi, On 02/23/2015 06:44 PM, Sebastian Urbach wrote: > Because the criterias changed a while ago, only the fastest 25% of the > Relays are Guards anymore. >BTW, what's about minimum uptime ? Details for all the flags can be found here: https://gitweb.torproject.org/torspec.git/tree/dir-spec.txt -- Sincerely yours / Sincères salutations / M.f.G. Sebastian Urbach ----------------------------------------- Religion is fundamentally opposed to everything I hold in veneration - courage, clear thinking, honesty, fairness, and, above all, love of the truth. ----------------------------------------- Henry Louis Mencken (1880 - 1956), American journalist, essayist, magazine editor, satirist and critic.

2 1

Relay Node not acquiring Guard Flag.
by Beagle Bone 23 Feb '15

23 Feb '15

Hey folks. 3xBT here, admin of the node of the same name. I was wondering why my node has yet to pick up the Guard flag: Fingerprint: D937161730610A5D66BDED6CF4D5C9692566D9FE Feb 23 06:25:05.000 [notice] Tor 0.2.4.24 (git-e3c61213fb2dc49a) opening new log file. Feb 23 06:25:05.000 [notice] Configured to measure directory request statistics, but no GeoIP database found. Please specify a GeoIP database using the GeoIPFile option. Feb 23 06:27:22.000 [notice] Your DNS provider gave an answer for "lya67fieutqf6", which is not supposed to exist. Apparently they are hijacking DNS failures. Trying to correct for this. We've noticed 1 possibly bad addre$ Feb 23 09:57:31.000 [notice] Heartbeat: Tor's uptime is 59 days 6:02 hours, with 153 circuits open. I've sent 414.64 GB and received 394.25 GB. Feb 23 09:57:31.000 [notice] Average packaged cell fullness: 97.080% Feb 23 09:57:31.000 [notice] TLS write overhead: 3% Feb 23 09:57:31.000 [notice] Circuit handshake stats since last time: 4059/4059 TAP, 3977/3977 NTor. Feb 23 15:02:49.000 [notice] New control connection opened. Feb 23 15:57:31.000 [notice] Heartbeat: Tor's uptime is 59 days 12:02 hours, with 158 circuits open. I've sent 416.55 GB and received 396.07 GB. Feb 23 15:57:31.000 [notice] Average packaged cell fullness: 97.087% Feb 23 15:57:31.000 [notice] TLS write overhead: 3% Feb 23 15:57:31.000 [notice] Circuit handshake stats since last time: 6032/6033 TAP, 4055/4055 NTor. Feb 23 17:23:54.000 [notice] New control connection opened. Additional info: When traffic is 4Mbit/sec, CPU and memory load is at ~50%. I'm also wondering why the log is only being written when I'm looking at it, and if there was anything I could do to increase usage of allotted bandwidth. -3xBT

3 2

drop in bandwith - because of fail2ban rule?
by tor＠viisauksena.de 23 Feb '15

23 Feb '15

hi i am wondering , because i constantly becoming less and less traffic / or given Bandwidth for a Tor exit relay with a bunch of flags .. the exit is on a debian, vserver with quit a lot of machine power behind, has it own IPv4 and there is also enough bandwidth (i checked this regulary with speedtests or fake downloads of whatever distros) https://atlas.torproject.org/#details/2AC2306BD625A9DD75532886842C268C3CDBB… i didnt change anything in configuration, beside one small thing after getting dozens of apache errorcode 504 port 80 and 443 to the Tor-IPv4.. and so i startet to make a fail2ban rule, because this doesnt make sense, also this comes often from a variety aof IPv4 en block from russia, china, korea (mostly) - so i optet for fail2ban more than ignoring these errors. This is the only thing i could imagine which connects to the network drop (ok some internet police whitehat watchers argue there is bad traffic here and than .. but this is "normal" i guessed for tor-exit) So i turned my rule of some 2-3 days, to see if this makes the drop in bandwidth - no effect. So i restartet back the fail2ban rule. So my question - tor hides in port 80 / 443 traffic - is this what i mistakingly block / or interfere .. or how this drop from near 14 Mb to 1,9 Mb is explainable? (while normal traffic on server goes well) thx, viisauksena (for completeness example of logoutput and fail2ban-regex ) # basicly i want to stop these lines # default-178_254_XXXXXX:443 104.245.96.249 - - [10/Feb/2015:16:52:07 +0100] "GET /" 400 549 "-" "-" [Definition] failregex = [^ ]+ <HOST>.*"GET /" 400 5[0-9][0-9]

1 0

Strong bumps in traffic with 0.2.6.3
by Christian Sturm 22 Feb '15

22 Feb '15

Hello, I noticed on my Tor relay that deploying 0.2.6.3 resulted in the bandwidth going up an down a lot which can be seen here: https://globe.torproject.org/#/relay/CE75BF0972ADD52AF8807602374E495C815DB3… It looks like I am not the only one. This CCC hosted relay (different OS, provider, etc.) appears to have the same thing happening: https://globe.torproject.org/#/relay/9BDF3EEA1D33AA58A2EEA9E6CA58FB8A667288… It is hard to filter relays per version right now (maybe something onionoo could support?). Are others experiencing the same problems?

3 3

Running obfs4proxy on Debian Stable
by isis 22 Feb '15

22 Feb '15

Hello, I requested that the obfs4proxy package in Debian jessie be ported to wheezy-backports, [0] however, it seems this is extremely unlikely to happen because it would mean backporting pretty much every Golang package in existence. I would be super stoked if we could make it as easy and seamless as possible for the Bridge operators who are still running obfs2 (!!) to move to supporting better, newer Pluggable Transports. Currently recommended PTs to run are: obfs3, obfs4, scramblesuit, and fteproxy. When Tor Browser 4.5 becomes stable (probably in mid-April 2015), we'll want lots more obfs4 Bridges! For the super adventurous sysadmins who'd like to try Yawning's experimental new post-quantum PT, Basket [1] is one of the newest PTs. We should probably come up with some easy instructions for operators of Tor Bridge relays who are running Debian stable, such as adding an Apt pin to pull in only the obfs4proxy package and its dependencies from Debian jessie and keep everything else pinned to stable. If someone has done this, or has another simple solution, would you mind writing up some short how-to on the steps you took, please? [0]: http://lists.alioth.debian.org/pipermail/pkg-anonymity-tools/Week-of-Mon-20… [1]: https://github.com/yawning/basket -- ♥Ⓐ isis agora lovecruft _________________________________________________________ OpenPGP: 4096R/0A6A58A14B5946ABDE18E207A3ADB67A2CDB8B35 Current Keys: https://blog.patternsinthevoid.net/isis.txt

5 10

Tor relay only IPV6
by cmar433＠yandex.com 21 Feb '15

21 Feb '15

Hello, i try to run tor as relay .. but i have not any ipv4 adress.. is there any posibilities run tor as realy only for ipv6 adress ? for me seems is not functioning. (Debian wheezy) port 9001 is open but "conection refused" if i try IPV6 portscan I try open 22 only for test trough IPV6 portscan .. ist OK . port opened Any IDEA ? Thanks

4 4

load balance across multiple WAN?
by Rupert Roe 21 Feb '15

21 Feb '15

Hi, I currently run this middle node from a residental VDSL connection: https://atlas.torproject.org/#details/D0D6992508E64E28A77373B82798AB196BFA5… I am currently limited by the upload speed of my connection (~20MBit), I was wondering if I had another VDSL connection installed would I be able to load balance the upload of the relay across the two connections? Or would this mess up the routing for my relay? I.e. traffic comes in to the single published relay IP (which is OK as it's ~80MBit download). Then the relay can push ~40MBit upload load balanced across two 20MBit connections. Would it be problematic because the traffic would come from two different IPs, one of which does not match the published IP for the relay? I hope that question makes sense?? Thanks -- +447867537146 skype: rupertroe1 --

3 3

eventdns: Address mismatch on received DNS packet.
by Jeremy Olexa 21 Feb '15

21 Feb '15

Hi List, I'm seeing these messages in one of my relays. Pretty often, too. eventdns: Address mismatch on received DNS packet. Apparent source was <IP>:<port> I've searched this and found references[1] to a faulty resolver of some type and torservers.net ignores the message[2]. I use my ISPs resolvers which are physically close to the server. In an attempt to fix this, I've added a caching local resolver to my server and configured resolv.conf properly (problem persists). Then I switched to Google DNS with caching in front (problem persists). Can anyone clarify what the problem may be? Or is it no problem at all? [1]: https://lists.torproject.org/pipermail/tor-relays/2013-July/002209.html [2]: https://lists.torproject.org/pipermail/tor-relays/2011-December/001034.html Thanks! -Jeremy

6 5