[metrics-team] Recent weird increases of relay users in sc, lt, ro, nl

[Karsten Loesing]

On 2017-08-14 18:16, David Fifield wrote:
> Perusing recent Metrics graphs, and looking at recent anomaly reports [1],
> I found some strange cases of apparent increased numbers of relay users
> in various countries. Only relay users are affected, not bridge users.
> The increases happened between 2017-07-31 and 2017-08-06.
> 
> 
> The most striking is in the Seychelles, where the count went from 400 to
> over 100,000.
> https://people.torproject.org/~dcf/metrics-country.html?start=2017-06-01&end=2017-08-20&country=sc

Is that the Seychelles with a population of 95k due to Wikipedia? ;)

> In Lithuania, from 2,000 to 70,000:
> https://people.torproject.org/~dcf/metrics-country.html?start=2017-06-01&end=2017-08-20&country=lt
> 
> In Romania, from 8,000 to 40,000:
> https://people.torproject.org/~dcf/metrics-country.html?start=2017-06-01&end=2017-08-20&country=ro
> 
> In the Netherlands, from 50,000 to 125,000:
> https://people.torproject.org/~dcf/metrics-country.html?start=2017-06-01&end=2017-08-20&country=nl
> 
> 
> The increases in the Seychelles and Lithuania seem to large to have a
> natural cause. I wonder if this is another case, like Turkey in December
> 2016 [2], or the U.A.E. in January 2017, where the increase is due to an
> artifact of counting. There may even have been a block that
> paradoxically appears as an increase.

I can only speculate here, because I didn't have the chance to
investigate this more closely. But if I were to investigate, I'd:

 - look out for single relays reporting unusually high numbers of
users/directory requests from these countries;

 - compare geoip file digests reported in extra-info descriptors to
files shipped with tor to spot any unusual files; and

 - try to find similar downturns in other countries that coincide with
these upturns and that together keep the total number of users
relatively stable.

I won't have time to look into this more closely next week, but maybe
somebody else on this list wants to give it a shot?

All the best,
Karsten



> 
> 
> [1] http://lists.infolabe.net/archives/infolabe-anomalies/2017-August/thread.html
> [2] https://bugs.torproject.org/21014#comment:13
> [3] https://bugs.torproject.org/21345
> _______________________________________________
> metrics-team mailing list
> metrics-team at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/metrics-team
> 


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <http://lists.torproject.org/pipermail/metrics-team/attachments/20170820/f77b6140/attachment.sig>