Re: [tor-relays] interesting network sockets pattern
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 08/25/2016 07:02 PM, Toralf Förster wrote:
This is a fresh new Tor exit, setup 4 days ago, https://atlas.torproject.org/#details/BE2FA9FCB6242567B93ED99FEC5543FC517C92... , where I do wonder how to interpret the attached screen shot.
The full SVG graphic can be derived from http://www.zwiebeltoralf.de/torserver/graph-20160825.svg (scroll down to the end) - -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF0EAREIAAYFAlfAOBwACgkQxOrN3gB26U7NEAD/U8eOOYq+sArqaGdrJ5+RzTUY G8duzPfhX6bbiI2u55cA93IBBN/7Hog4WhftxhM681ntxKk44KkYOryqyIaBZp4= =WWe1 -----END PGP SIGNATURE-----
On Friday 26 August 2016 14:37:48 Toralf Förster wrote:
On 08/25/2016 07:02 PM, Toralf Förster wrote:
This is a fresh new Tor exit, setup 4 days ago, https://atlas.torproject.org/#details/BE2FA9FCB6242567B93ED99FEC5543FC517 C9276 , where I do wonder how to interpret the attached screen shot. The full SVG graphic can be derived from http://www.zwiebeltoralf.de/torserver/graph-20160825.svg (scroll down to the end) Hi Toralf,
I see the same patterns on my relays from time to time. Please see my 2012 posting https://lists.torproject.org/pipermail/tor-relays/2012-December/001781.html on [tor-relay] on that subject. I still have no idea what causes the pattern. Regards, torland
i looked but i don't see anything interesting. what is the pattern you are referring to? On Fri, Aug 26, 2016 at 02:37:48PM +0200, Toralf Förster wrote:
On 08/25/2016 07:02 PM, Toralf Förster wrote:
This is a fresh new Tor exit, setup 4 days ago, https://atlas.torproject.org/#details/BE2FA9FCB6242567B93ED99FEC5543FC517C92... , where I do wonder how to interpret the attached screen shot.
The full SVG graphic can be derived from http://www.zwiebeltoralf.de/torserver/graph-20160825.svg (scroll down to the end)
-- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 08/27/2016 10:36 AM, dawuud wrote:
what is the pattern you are referring to? The up and down of about 2,500 socks within a short time period
- -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlfBZ8YACgkQxOrN3gB26U6GEQD/VXEmJpJbN2e0/0pU7tRC4PUL B1MgZzFms2ZEs421AqEA/22gb7A2bIJvhGJANrs94skq3DAo9JrxKrkvuQvtFr7T =QAmM -----END PGP SIGNATURE-----
does this same graphy display differently for different periods of time or on a larger time scale? did this recently started happening? assuming you run linux i suppose those numbers were generated via /proc/net/tcp? i wonder if you've got lots of sockets in time-wait, which isn't necessarily a problem but it might tell you if the connections were closed from your side or the other side. maybe you should graph this as well to see if it's corrolated with the socket graph: ss -tan state time-wait | wc -l On Sat, Aug 27, 2016 at 12:13:26PM +0200, Toralf Förster wrote:
On 08/27/2016 10:36 AM, dawuud wrote:
what is the pattern you are referring to? The up and down of about 2,500 socks within a short time period
-- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 08/27/2016 12:47 PM, dawuud wrote:
i wonder if you've got lots of sockets in time-wait, The blue line in the graph are already tcp-tw.
- -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlfBn+QACgkQxOrN3gB26U5WfQD+OYWNjSUJXwyuny4xlDk95lWT tnCBbPGbzQyt1D5Msh4A/3pEAD+K9iydND1esWCPJMgtT7Phs3kvKGgBIcNWI0K7 =8W5f -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 08/27/2016 12:47 PM, dawuud wrote:
does this same graphy display differently for different periods of time or on a larger time scale? did this recently started happening? This is a new system re-using the same IP of the old exit relay where I didn't observed that behaviour. It started soon after the Tor exit relay was setup up.
http://www.zwiebeltoralf.de/torserver/graph-20160821.svg - -- Toralf PGP: C4EACDDE 0076E94E, OTR: 420E74C8 30246EE7 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlfBoegACgkQxOrN3gB26U52lQD9GPbNTinPSEjQAeyc4US3X/D+ DZSuSrOxuuyZHltQRbMA+QH27Qp1GKizhrquQ4QH0OsivGrJ9L0CSKlNfDhN1644 =nYeB -----END PGP SIGNATURE-----
On 26/08/2016 14:37, Toralf Förster wrote:
On 08/25/2016 07:02 PM, Toralf Förster wrote:
This is a fresh new Tor exit, setup 4 days ago, https://atlas.torproject.org/#details/BE2FA9FCB6242567B93ED99FEC5543FC517C92... , where I do wonder how to interpret the attached screen shot.
The full SVG graphic can be derived from http://www.zwiebeltoralf.de/torserver/graph-20160825.svg (scroll down to the end)
Hi, In my exit relay[1] sometimes I see the orphaned sockets rising up for small period of time (usually a couple of minutes) and hit the max value I set up (32768). It could be the same issue. As you can see from this log there is a small increase of the timewait too: [Aug 19 06:28:20 CDT 2016] Total: 3750 (kernel 3842) TCP: 6340 (estab 3583, closed 2694, orphaned 18, synrecv 0, timewait 2691/0), ports 4493 [Aug 19 06:29:20 CDT 2016] Total: 10886 (kernel 11022) TCP: 21925 (estab 10673, closed 2820, orphaned 8342, synrecv 0, timewait 2817/0), ports 18948 [Aug 19 06:30:20 CDT 2016] Total: 5935 (kernel 6253) TCP: 32393 (estab 5683, closed 2826, orphaned 23752, synrecv 0, timewait 2823/0), ports 28711 [Aug 19 06:31:20 CDT 2016] Total: 4474 (kernel 4765) TCP: 17208 (estab 4131, closed 2311, orphaned 10551, synrecv 0, timewait 2300/0), ports 14818 [Aug 19 06:32:20 CDT 2016] Total: 4162 (kernel 4252) TCP: 6375 (estab 3918, closed 2274, orphaned 60, synrecv 0, timewait 2271/0), ports 4702 [1]https://atlas.torproject.org/#details/2B72D043164D5036BC1087613830E2ED5C6069...
participants (4)
-
dawuud -
patacca -
tor-admin＠torland.is -
Toralf Förster