- tor-relays - lists.torproject.org

Received botnet/drone abuse complaint
by Steve Snyder 03 Jan '12

03 Jan '12

I received a botnet/drone complaint from shadowserver.org today (delayed due to holidays) regarding my exit node: timestamp ip port type infection cc cc_port 12/29/2011 19:52 173.208.132.210 48586 32097 US MISSOURI KANSAS CITY tcp mebroot ukixxuug.com|MAOS/0EC20201 14DF137A55320641 84.163.151.128 80 3320 DE 1 If I'm reading this correctly, they identify "mebroot" as the source of the problem. As this is a Windows MBR trojan it obviously doesn't apply to my Linux system. I scanned my system anyway and found no unexpected processes running. My DirPort is set to 80, which may explain that value in the complaint. Any thoughts on what to do to avoid further complaints? Shadowserver addresses the topic of Tor exits here: http://www.shadowserver.org/wiki/pmwiki.php/Involve/TORNodesAndReporting Thanks.

2 1

planned downtime
by cmeclax-sazri 02 Jan '12

02 Jan '12

Sometime this week (I haven't decided when yet) I'll be down for a few hours to upgrade memory. cmeclax

4 3

Abuse complaints about brute forceing via ssh
by Klaus Layer 02 Jan '12

02 Jan '12

Hi, within two days I received abuse complaints from my ISP that someone used my exit node to brute force ssh accounts of two different ISP. Unfortunately I am forced to block port 22 to avoid shutdown. Anyone else who suffered from such attacks these days? Regards, Klaus

7 8

unplanned outage
by cmeclax-sazri 27 Dec '11

27 Dec '11

I have been off line since noon (17 UTC) Friday when a man with a backhoe cut the thicknet cable that connects me to the Internet. The repairmen just came and patched the cable and I am on line again. cmeclax

2 2

Bandwidth Authority PID Feedback Experiment #2 Starting
by Mike Perry 22 Dec '11

22 Dec '11

Over Thanksgiving and into early this week, we ran an experiment to test a feedback mechanism to attempt to allocate usage of the Tor network such that the measured stream capacities through all relays became equal: https://gitweb.torproject.org/torflow.git/blob/HEAD:/NetworkScanners/BwAuth… This experiment failed in 3 ways: 1. It drove many relays down to 0 utilization. Scott Bennett noted this in his post to tor-relays, and at least one 10Mbit relay operator also commented on the traffic drop-off of their node in #tor. 2. It only created one PID 'setpoint' for the entire network, even though different types of nodes see different load characteristics, and despite it being impossible to shift load from an Exit node to a Middle node, for example. 3. It kept allocating bandwidth to some relays (especially Middle and non-default-policy Exits) until they hit INT32_MAX in the consensus, and everything finally exploded. We then shut off the feedback by removing the consensus parameters. I've made five major changes to try to address these issues: 1. Don't perform multiple rounds of negative feedback for slow nodes. 2. We now group nodes by their flags into four categories (Guard, Middle, Exit, and Guard+Exit), and compute a different PID setpoint for each class. 2. Circuit failure now counts more. Circuit failure is our CPU overload signal, as nodes that hit CPU overload being dropping onionskins and failing extends. Instead of using the circuit success rate as a multiplier against the pid_error, we now actually compute a circ_error similar to the pid_error, and use it as the pid_error if it is more negative. We also now set FastFirstHopPK 0 to ensure that Guard nodes also get tested for circuit failure. 3. Raised the PID setpoint slightly, which should prevent us from piling quite so much weight onto fast relays. 5. Cap feedback via a consensus parameter. All of these changes are governed by consensus parameters. See: https://gitweb.torproject.org/torflow.git/blob/HEAD:/NetworkScanners/BwAuth… for more details. The parameters governing feedback are bwauthnsbw=1 and bwauthti. So long as one or both of these are present and non-zero in the consensus parameter list, the feedback experiment is active. We'll probably be running this next experiment for about a week (or perhaps longer if it doesn't explode and seems to improve performance on https://metrics.torproject.org/performance.html) starting tonight or tomorrow. Please keep an eye on your relays and tell us if anything unexpected happens over the next week or so. Thanks! -- Mike Perry

8 26

arm client locale stats on connection page
by Klaus Layer 20 Dec '11

20 Dec '11

Hi, I am using arm to monitor 3 tor nodes running on the same box. On the connection page I get very different results when pressing "c" to get the client locale stats: Node A - nothing happens Node B - the window with the client locale stats is displayed Node C - a message "Usage stats aren't available yet, press any key..." is displayed Under which conditions are the stats available? Regards, Klaus

2 2

bandwidth authority test
by Softail 12 Dec '11

12 Dec '11

I'm also running a guard relay that for some months was pushing 600kBs pretty steadily. In the last couple weeks it's lower and very variable and today it has basically cratered. Is this a likely results of the bandwidth algorithm testing that's going on or might I have other problems? Thanks, Wayne -- A man in chains knows he should have acted sooner... Julian Assange

1 0

ARM crashes on connection tor
by Klaus Layer 10 Dec '11

10 Dec '11

Hi, I am no longer able to connect with ARM to one of my relays. ARM crashes with the following error: debian-tor@host:/home/user$ arm -i 127.0.0.1:4711 Traceback (most recent call last): File "/usr/share/arm/TorCtl/TorCtl.py", line 710, in _loop isEvent, reply = self._read_reply() File "/usr/share/arm/TorCtl/TorCtl.py", line 885, in _read_reply raise ProtocolError("Badly formatted reply line: unknown type %r"%tp) ProtocolError: Badly formatted reply line: unknown type 'P' Terminated To another instance running on the same machine ARM connects without any problem. Has anyone experienced the same issue or knows how to fix it? Thanks, Klaus

3 3

Logs full of "eventdns: All nameservers have failed"
by Klaus Layer 10 Dec '11

10 Dec '11

Hi, my logs are full of these messages: 05:54:07 [NOTICE] eventdns: Nameserver 127.0.0.1 is back up 05:54:07 [WARN] eventdns: All nameservers have failed At first I thought that the DNS of my ISP sucks, so I changed to Google Public DNS. But the warnings are still there. Google shows some older reports of this warning, where is was supposed to be an error in tor. Are there any news on this? I am wondering if the high bandwidth nodes from torservers and noisebridge also show this kind of messages and how they configured their nodes to get rid of it. For my node they come up every couple of minutes. Between fail and recover is always less than a second. Best regards, Klaus

5 11

Significant relay usage drop down
by Klaus Layer 09 Dec '11

09 Dec '11

Hi, I am running two relays with the fingerprints D223399907113A1F216AAA64997BC1D4CFA8E1AC and 945CBBA599808018749DDC4EBB592168F2858C1B. For the first relay I am observing a significant usage drop down during the last 12 hours. The second runs as usual with a high throughput. I am wondering what the reason for this drop down could be. Are there any changes in the configuration of authorities? Is someone from the core TOR developers doing tests with the load distribution? Best regards, Klaus

3 3