Re: [tor-relays] DoS attacks are real (probably)

Quoting Felix (2017-12-11 17:07:30), as excerpted

Hi Alex

Great points.

...

conntrack -L -p tcp --dport 9001 | awk '{print $5}' | sort | uniq -c | sort -n

On FreeBSD one can do:

yeah, the optimal rule would ban "bad IPs" after some threshold of connections, like "if one IP makes >1 conn/sec for at least 1 minute ban for 1 hour" or something. I'm hoping to fix the underlying issue in Tor so that low-bandwidth attacks like these are less effective.