> I doubt this bug is the cause if it's just happened recently.

> It's more likely that your relay is the HSDir for some popular

> onion service. Or a genuine DDoS.

I still don't know what's going on. I'd say any of these are possibilities:

- The bug that results in fallback directories getting extra DirPort traffic (23862)

- DDoS

- HSDir activity (the node in question did have the HSDir flag before being knocked offline)

- A connection limit upstream

> Can't your provider support that many connections?

I'm not sure. I know I haven't had this problem until recently. This node has been around on the same provider at the same IP for 700+ days. So I'm leaning away from this being a provider-level issue, but I don't really have the data to back that up. Any suggestions as to how I could make this determination?

More broadly, any tips for troubleshooting this beyond looking in the Tor logs and syslog would be appreciated.

> There's 0.2.9 nightly, but I don't know if we have an 0.2.9-release build.

Yeah, unfortunately I could not find a 0.2.9.12 dpkg. I did find a deb, but it wouldn't install due to mismatched dependencies. I was able to get 0.2.9.12 installed from source, and briefly had it running, but it didn't have a service wrapper, and generally doesn't jive with my normal practices and Ansible scripts and such. So I bailed on that and am running the latest 0.3.1.7 package from the torproject repo again.

It's a shame there's no Ubuntu package for the long-term support Tor release. Thanks Teor for filing a ticket, but it doesn't look like it will be acted upon. It seems like a problem to me. I guess it's a matter of what is considered "stable"? Seems like the package maintainer thinks 0.3.1.7 is stable, while you (Teor) think it's not? I'm stuck with it for now.

I've scaled both of my fallback nodes up a bit (more CPU and RAM), and things seem stable at the moment. We'll see what happens. I'll take note of when the HSDir flag comes back.

Thanks for everyone's help.