Re: [tor-relays] A bit more evidence on circuit creation storms
I added a second core to my server and it's still getting "Your computer is too slow..." error messages. Top shows cpu for the Tor process hanging around 60-75%, which is where it was before. Top's system total is hanging around "Cpu(s) 25.9%". That plus the VM manager's graph suggest that the server's not doing much with the second core. Also see a repeat of the odd log message with the 154.x net address someone else described with the huge hexidecimal string (40 hex chars, + sign, 40 more, on and on). On Friday 30/08/2013 at 4:09 pm, David Carlson wrote:
On 8/29/2013 11:09 PM, Andreas Krey wrote:
On Thu, 29 Aug 2013 19:35:37 +0000, Gordon Morehouse wrote: ...
Aug 29 18:19:14.000 [notice] Your network connection speed appears to have changed. Resetting timeout to 60s after 18 timeouts and 172 buildtimes.
Random data point: I had these yesterday on a VPS-based relay.
My main question: How do circuit creation requests on one's Tor relay cause load on one's network infrastructure? Is it DNS requests? Is it TCP connection state entries? It's not bandwidth, we observed that above, and my router can handle far faster pipes than the one it's on currently. The DNS failing is a sign that the router is under severe stress.
Possibly your uplink is full (supposing you're on some DSL), and is starting to build up ping time; then DNS requests to the outside can start to timeout.
Andreas
Over roughly the same time frame I received an incredibly high number of spam e-mails in one e-mail account that normally gets 20 or so a day on quiet days. Perhaps this is another example of mal-ware in action.
David C _______________________________________________ tor-relays mailing list tor-relays@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
On Fri, Aug 30, 2013 at 04:25:27PM -0400, tor@t-3.net wrote:
Also see a repeat of the odd log message with the 154.x net address someone else described with the huge hexidecimal string (40 hex chars, + sign, 40 more, on and on).
Just FYI, these messages were popping up pretty regularly in March 2013. At the time Roger seemed to think the directory server on 154. was overloaded. It looks like it's limited to 500k/s and has been bumping into that ceiling consistently over the last few days: https://atlas.torproject.org/#details/CF6D0AAFB385BE71B8E111FC5CFF4B47923733...
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Since I originally started keeping an eye on these on my Raspberry Pi relay (read: slow, resource-limited), I've got to wonder if the circuit creation storms I was seeing months ago weren't normal network phenomena but some kind of test run. We are talking going from 50-250 circuits to thousands of requests per *second* out of nowhere, and then if the machine survived it, the storm disappearing as suddenly as it came. This was happening months ago, but less frequently and only on lower-end hardware. Now it's happening everywhere. Even if the previous case *were* "normal" Tor network operation, I'd say it's a bug, but I'm suspicious that it was whatever is going on now in its test phase. tor@t-3.net:
Also see a repeat of the odd log message with the 154.x net address someone else described with the huge hexidecimal string (40 hex chars, + sign, 40 more, on and on).
Here as well. I believe this is the sign of an overloaded Tor directory server.
Over roughly the same time frame I received an incredibly high number of spam e-mails in one e-mail account that normally gets 20 or so a day on quiet days. Perhaps this is another example of mal-ware in action.
Funny, one of the dropped connections during my storm last night was to port 993... :P Best, - -Gordon M. -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJSIU2zAAoJED/jpRoe7/ujMm4H/iruokRzfasoJy7jdXF0bMJT 5W94DUUzZJV+XbJIr208PxKFmElOUKLP/L/1Dqlx8csPFqqi6pN4yvBC26QMgxhh lrcnyV0PaUAc8rwhK9cVKwl/JIoxsHFxpxL1fJBAbO9vzyr5XxKyCwiSNuIco7ip RZEQc8/3pr/TsivTWUwSNcFtDUiFLi7+IrvGcPNG3bSbOfLhXzzfQ1SILzoy4ddm jFW31hw/O8/J/P0XC2SbH1n1NsW7GdhhOQMoIx66d/znhy4ir9k7vdcq4MNoYwTx SSGZc6HcZysmG78fMe7Eo00kv5sLygZnkGhZkFZEzKcjaKJoopFqnCLd60iW1lQ= =SaO7 -----END PGP SIGNATURE-----
participants (3)
-
Gordon Morehouse -
tor＠t-3.net -
Troy Arnold