Tor relay doing 400 Mbps up, 50 Mbps down until reboot
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Hello. One of my relays, 54C85B97B4A5253483AA269B341C4CCF9328C443, had 400 Mbps up and only 50 Mbps down for several hours. Performance got so bad that could barely SSH in. Unfortunately, I rebooted before doing diagnostics and the problem has not happened since, so I couldn't see if Tor logged asymmetric bandwidth use in its heartbeat. Nothing in the logs indicate anything abnormal. This started on Jun 25th, 12:30 AM UTC and continued until I rebooted at around 4:00 AM UTC. Tor's CPU use was 100% for the duration of this event and the uplink was not saturated. Is this something that has happened before? Could it be some DoS attack? As far as I know, the only way to get Tor to use asymmetric bandwidth is to use it as a directory mirror. Regards, forest -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQQtr8ZXhq/o01Qf/pow+TRLM+X4xgUCaj2vuwAKCRAw+TRLM+X4 xhhPAQDqw7+xxZWmOUP00rTmyT1brTFdkTRwEUWWmSdx1njWLAEA8lttz57jLKO7 zZSJyBW02z8rMKds0SpRiP2heVBfFwQ= =ecuY -----END PGP SIGNATURE-----
Hi, something similar happened to my guard/middle relay last week. Normally i have around 30-40 Mb/s in/out going traffic with a few Mb/s more outgoing traffic. But for approx. one hour i had 360 Mb/s outgoing traffic on the affected relay. After the first hour of the abnormal traffic the outgoing traffic dropped to only about 180 Mb/s and it normalized after another hour without my intervention. However, during the high outgoing traffic my relay was shown in tor metrics as offline and afterwards as overloaded. The incoming traffic remained the same as usual. The tor logs itself only showed a lot of these messages: "Your computer is too slow to handle this many circuit creation requests! Please consider using the MaxAdvertisedBandwidth config option or choosing a more restricted exit policy. [2490 similar message(s)" And at the end of all of the warning messages i got this message: "General overload -> Ntor dropped (85308) fraction 1.2472% is above threshold of 0.5000%"
participants (2)
-
forest-relay-contact＠cryptolab.net -
tor.kmv82＠simplelogin.fr