Hi all, I am observing the same behavior with one of my FreeBSD relays. All hover around 15k active TCP states according to the pf firewall, except one, which hovers around 90k TCP states. All run tor version 0.4.9.11. The affected relay's fingerprint is the following: CE0D31663C7CE954B1944B6D65449963F12BDF78 Other things I have observed: At 8 am UTC the CPU usage of the affected relay spiked sharply, while traffic simultaneously dropped significantly. At around 10:50 am UTC, outgoing Tor traffic dropped to around 5%, while incoming traffic sharply rised to 135% of normal network traffic. The relay was completely unresponsive up until around 4:22 pm UTC, when traffic returned to normal, except for the 6x increase in TCP states. I suppose my relay was hit by some kind of DoS attack? In the syslog I can see pf firewall entries about hitting max states, which are at 100.000 concurrent states, which is abnormal. Another thing I've seen is that some other Tor relays have between 10 to 200 TCP states, even though they only have 1-8 Tor sessions running from their source IP addresses. Strange, but unrelated: - There hundreds of IPs from the same /24 networks accessing my Tor relays, all hosted on Contabo, which don't seem to be Tor Relays, but also don't look look like Tor bridges either (?). - All of them account to around 6k TCP states, all wit around 50. I don't know what I should to with this information, but maybe someone finds this interesting. Cheers, ZR On Saturday, July 4th, 2026 at 11:20, ProSecureRelays via tor-relays <tor-relays@lists.torproject.org> wrote:
Hi there,
I want to report abnormal Firewall States since the update.
Since a week or two, (I believe with 0.4.9.10) tor started to excessively use Firewall-States, far beyond what I observed beforehand.
In normal operation, I observed about 20k – 45k Firewall States for the relay.
Yesterday, before I installed the update, I had 190k Firewall States, related to Tor Relay Traffic.
The days before it cycled from 120 – 145k States. Also far more than normal.
Today, I see excessive Errors (> 20 Errors/Sek) in my Firewall, relating to use of invalid Firewall States (pf: BAD State..) – all are Tor Related Connections.
It would be nice if anyone could have a look, if your connections increased also that much. I also wonder if this might be a type of attack?
Regardless of the odd connections, the relay is running well, no CPU peaks and normal memory usage (602MB).
Best regards and have a nice weekend!
Joker