[warn] Content-Length is less than zero; it looks like someone is trying to crash us
-----BEGIN PGP MESSAGE----- Charset: utf-8 Version: GnuPG v2 hQQOA9vCYl42+L0WEBAArg1D4faK3HdxN9Zqql89LPgFAdUVfIuyS+HdMpeHYGcU bHuEAiFA20YWtXTqvEQZ3T1FFCN5tX3psIJdfSUmvIEo8Q8vvK18g2wAiyXUp+aG Rvm4KLfjVIYVNTO4jc3t9rFiaIhE1OtF9IY41Cr9UPZ4ICkg2Yszvy49F9FVPrjY vEvu0ng3FIdFVdNTXFg+UZ+qN7Rvv/P2cWlcgLfltE6pne+7WHFy/KTNClysyEmF ee0QciCcqs+qLAeYpKyDfbUUQMiYxA0rUKk/o6UMJyAmzwNSr+i/cY1LWhyvBaHk 7c2lqBsj2SQQeqMEnrENE/hHRdOOIMSe06lSRcOt4HG8y1MFGhOvXmA+3CyR4EYk +MazRhZ+obOwhOCo1Hq7bRnuZygRL/sE/AY+MX/OQ7Cy/MaFhIHdIdc9HZ50VgZB Ze9TclgA/Tl+hMGSG6kyuagx3K0GrdrhfAmIZltKezqFG9ug+PLEiscZ5oSBZLKz Zpft46iKSme6zhtx63CJUsoxHF73OzTkW2zVPRpsPCXW3cpMlaya/Mb9B8yB8Bqa lRbC2mql7hWMwmOCC4x5OP7usztiu7BNY53hb5FYKpwCWcM+gNFP6TR3CD+uOvVp 0kzJb+GX6bm0j4S5TcAg8BcEvVjCbtiUJfPrLDuqaZwdQSsQd0hA6wU72WhMEFAQ ANF59cv9JL2u+9o92VZ38ROvh0Cph34MAbn/s7keZWaKRb4GXaeSDeHdAnT9mMlb Pu6s+K5YrOysxA0OwICfn9GNfOPDi8paP0eCZebp8SOKwmLo/u2H9jYdqPqzgo0U scjPZA0reKBskdoPFZtdiGy/Pwb+SWjolnpjSJOOj2ziCgt0VZOyMfU+8X1T2Foj 7OqAcmz/gihhGG86g2fstF26M0rPtbB7ug9MWdxk9hNDnt14NW1+Zxa/XouWhF2x e5vbX4bSCMczD4zey0G4U0kSjJKs88CQ1dPWeHW4fZEVby1cEdq1WxS3Rz9hFWp9 uGNJZvg1NEs8JiznyKYm1ae8wzacXt0LFEJbf0NfZFxHRYdBaJ37xg1PErOIyAhJ FbEDZOTY012xf9ZgeY8FOAYVbj61v9QuB3In48m0xNNv3/fyIuUuECtuyTfOwHyt pm+oPjF7Vckj9FEljmct5qDceDbgaZU71F1cVGCM4MRhpbYw2RVSuGzjfJmkyhty cLWHysQfBI9qGjDLvyY6y5ffJX7IpwngwSXG0AgQRafAUO70ubeWMm7ExKLqgMyG LiPp5lxZj9W+bwp/pmkaAreXzZRsxwjIGsob+oLN8PFO3eU6rk2lWsNjGF8t0nWa hn8+3Oqdi00/ij1DPLuL0j7SasC1HosU6MAhgoG6gDo+0ukBSKVDsVwkavPTT1aD fwoCUhsIUtRz3O9nmVTppPk5s4XpCbKcn9SJziyDRpHoMIiXib58lOq/MjzfB6pf YUkDkvUJ0AghuPDl0LbkEPGi9WrwZSfoZxNXSj7AxdsqQYrkw/UwUrclDg8npP1R ptwGJVWbrri5lzEhFYliFQN7qgxsCicdZeZPza130gC//J4oZ0GcIzZK37NIduSQ xpCtMeofaHnUaq7hQnwk6Ac/Ct3FXY+TDbhOPKkpyH/ldRxoY25eDOvsdnMVQEo6 whooRuAiVqumMZor4hWvaJ7+/IwcgfM48xb4kxAq6iihzFCqzAQRZPIsLFyTGXn/ Z09jVjK6SaKj1U+DolmmpmIsQSmyj7G21oXO0gaf0Yu4dhjnorndQ2UoYOUSrzyg 7W2lkc64VszELxYL/sdXxbGmdJXwQKb8hVYy6DuD2xpZnp17WdvcxfhrsPnP19Th V9k1qDSSdftFcDLzKLp5yp5hJQQVnaVLFY4lrADSj996uxVYUBj6rUyl+YuLF+Sg FGWD76DiGbfo33uhC/UDgspITD3laFZlAB1FBBnondXOn6QRHXqqM+QS3mSa5h7c jSHLi68tZro5nkq4GWv/NKX0qaZVYwqi8Klzuzzk5zpuoPslk8EEtMB24BeTj8/F ugl7/GrS+cHqyO+kApXT8XdHba0L0Z0y+/geHwwgsCd5RXjqKJssEAFrgh28+zgp faJdt3bFa9CZWQnYXOwP7G8F+x10Eo9uRC6esSDmiwLvg6f6u2BBX4FJTeQl9Exd 18+P/JDmT5SM7BsfaCXhLVK15aEeSDnZkoTP0bkbeIAAJU0gkSWnGlS0WzBSqQBZ sNNVLhBbaDGI1kQuf6SUO5ULrmzU37ke9xSBucH4IrH2pEWygrKuJn1E9G+M7QBj vQ== =j7hG -----END PGP MESSAGE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 07/23/2015 02:26 PM, Pascal Terjan wrote:
You message seems encrypted with your own key so only you can read it.
Ick, again here just signed : Got the warnings messages today morning for the first time -I'm just curioius if somebody else was affected too ? Jul 23 09:32:22.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:32:22.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:32:22.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:32:23.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:32:23.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:32:23.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:32:23.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:32:24.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:38:11.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:38:13.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:38:13.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:38:56.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:38:56.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:15.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:19.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:19.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:20.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:20.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:20.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:20.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:20.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:20.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:20.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:20.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:21.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:21.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:21.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:21.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:21.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:21.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:21.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:21.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:21.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:21.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:22.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:22.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:22.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:22.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:22.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:22.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:22.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:22.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:23.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:23.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:23.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:23.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:23.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:23.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:23.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:23.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:23.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:23.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:24.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:24.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:24.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:24.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:24.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:24.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:24.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:24.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:24.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:24.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:25.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:25.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:25.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:25.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:25.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:25.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:25.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:25.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:25.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:25.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:26.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:26.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:26.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:26.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:26.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:26.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:26.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:26.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:26.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:26.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:27.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:27.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:27.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:27.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:27.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:27.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:27.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:27.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:28.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:28.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:28.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:28.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:28.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:28.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:28.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:28.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:28.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:28.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:29.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:29.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:29.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:29.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:29.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:29.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:29.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:29.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:29.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:29.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:30.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:30.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:30.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:30.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:30.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:30.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:30.000 [warn] Content-Length is less than zero; it looks like someone is trying to crash us. Jul 23 09:39:30.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. Jul 23 09:39:31.000 [warn] Request too large from address '[scrubbed]' to DirPort. Closing. - -- Toralf, pgp key: 872AE508 0076E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlWw4iMACgkQxOrN3gB26U6lVQEAjilfJre5NHMfhVH3lLbbNm4Z kKWu7y5EomEobNKOp9kA/1TeetoKvVoq6PmSImKHPRVy4Z0yN4XYyabWFbeHdd2g =ZILy -----END PGP SIGNATURE-----
Yes, I got the same thing recently. A burst of 56 of these log entries over a 3-minute period on July 21st. Seen with v0.2.6.10. Somebody shaking doorknobs. On Thursday, July 23, 2015 8:46am, "Toralf Förster" <toralf.foerster@gmx.de> said:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 07/23/2015 03:38 PM, Steve Snyder wrote:
Seen with v0.2.6.10. yep, 0.2.6.10 here too
- -- Toralf, pgp key: 872AE508 0076E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlWxNL0ACgkQxOrN3gB26U4eBQEAh8Vdxp1dxod0hYpmiCIEPJkV 9jwVt5bJa4FXXR9ricIA/R+2PFRg3ZSuTk4gVQh8SKF6qGa5W0Y309/ZpxAsrDP0 =UFQ6 -----END PGP SIGNATURE-----
On Thu, Jul 23, 2015 at 09:38:02AM -0400, Steve Snyder wrote:
Yes, I got the same thing recently. A burst of 56 of these log entries over a 3-minute period on July 21st. Seen with v0.2.6.10.
Somebody shaking doorknobs.
If your DirPorts are on port 80, it might even just be a random bad person on the Internet who thinks he is attacking webservers, and doesn't even know it is Tor. I guess at some point we should make these into protocol-warns (meaning they're info-level logs unless you set "ProtocolWarnings 1"), since there isn't really anything you should *do* in response to them. --Roger
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 07/23/2015 09:59 PM, Roger Dingledine wrote:
indeed - port 80 here.
- -- Toralf, pgp key: 872AE508 0076E94E -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iF4EAREIAAYFAlWxVvUACgkQxOrN3gB26U4HYQD+Js4mdkSvHpqft2jHiq9fwov/ hGEGb3goh6bg2W7lKkgA/2hn2YvqlYs11xpstbNUxD+w6GvqMNBflzRAkiy8TnjZ =FVe3 -----END PGP SIGNATURE-----
participants (4)
-
Pascal Terjan -
Roger Dingledine -
Steve Snyder -
Toralf Förster