Hi operators,
for a couple of days, I see a little bit more than twice as much inbound than outbound connections on my (non-exit, non-guard) relay [0]. I have no real concern about this but I want to explain it to myself somehow.
As my relay has the HSDir flag, I started looking at the statistics: The graph for relays with HSDir flags went down by approx. 500 relays in the past days [1], but that’s pretty much traceable to a lot of relays updating from Tor 0.2.6.x to 0.2.7.x (there’s a similar behaviour around Nov 23rd [2] where the updates started as well as around June 08th [3] where updates from 0.2.5.x to 0.2.6.x started). On the other hand, the number of HSDir flags was fluctuating quite a lot looking at the year up to now [4] which never had this effect on my relay.
After all, looking at the graphs in atlas (as well in arm) shows no significant (= something like twice as much) difference between the inbound and outbound traffic - so I’m scratching my head now.
Another open question would be if HSDir connections are considered as in- or outbound. Up to now, I held the HSDir flag responsible for the slightly higher outbound traffic…
So, again: Still no real concern from my side (as my relay is running fine - if it would be an attack, I would be able to feel that, right?), but I would like to understand what’s going on. :-) Maybe one of you here has an idea about this or experienced something similar.
To all of you an early “happy holidays”!
Cheers, Jannis
[0] https://atlas.torproject.org/#details/8827944C4BDCBDAC9079803F47823403C11A9B... [1] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=20... [2] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=20... [3] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=20... [4] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=20...