Hi operators,
for a couple of days, I see a little bit more than twice as much inbound than outbound connections on my (non-exit, non-guard) relay [0]. I have no real concern about this but I want to explain it to myself somehow.
As my relay has the HSDir flag, I started looking at the statistics: The graph for relays with HSDir flags went down by approx. 500 relays in the past days [1], but that’s pretty much traceable to a lot of relays updating from Tor 0.2.6.x to 0.2.7.x (there’s a similar behaviour around Nov 23rd [2] where the updates started as well as around June 08th [3] where updates from 0.2.5.x to 0.2.6.x started). On the other hand, the number of HSDir flags was fluctuating quite a lot looking at the year up to now [4] which never had this effect on my relay.
After all, looking at the graphs in atlas (as well in arm) shows no significant (= something like twice as much) difference between the inbound and outbound traffic - so I’m scratching my head now.
Another open question would be if HSDir connections are considered as in- or outbound. Up to now, I held the HSDir flag responsible for the slightly higher outbound traffic…
So, again: Still no real concern from my side (as my relay is running fine - if it would be an attack, I would be able to feel that, right?), but I would like to understand what’s going on. :-) Maybe one of you here has an idea about this or experienced something similar.
To all of you an early “happy holidays”!
Cheers, Jannis
[0] https://atlas.torproject.org/#details/8827944C4BDCBDAC9079803F47823403C11A9B... [1] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=20... [2] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=20... [3] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=20... [4] https://metrics.torproject.org/relayflags.html?graph=relayflags&start=20...
"I see a little bit more than twice as much inbound than outbound connections on my (non-exit, non-guard) relay [0]."
"looking at the graphs in atlas (as well in arm) shows no significant (= something like twice as much) difference between the inbound and outbound traffic"
I'm not sure if you mean the literal number of connections, or if you're talking about bandwidth utilization. In either case, if arm isn't showing the increase, the additional traffic might not be coming from Tor.
Have you considered other services running on the host?
You could always take a look at the traffic. You could use something like 'iftop' on Linux (turn on the port display) to get a really quick picture.
Hi,
thanks for your answer.
On 21.12.2015, at 02:17, Green Dream greendream848@gmail.com wrote: I'm not sure if you mean the literal number of connections, or if you're talking about bandwidth utilization. In either case, if arm isn't showing the increase, the additional traffic might not be coming from Tor.
It’s the number of connections, sorry if that wasn’t clear.
Have you considered other services running on the host?
I’m using the host just as a relay, nothing else.
In the meantime I realize that connecting “inbound connections” to something like “inbound traffic” is a mistake. So everything runs as it should, I would say.
Sorry for this rather unnecessary thread! :-)
tor-relays@lists.torproject.org
-
Green Dream -
Jannis Wiese