No subject
Mon Jun 20 21:04:01 UTC 2011
files via FTP or something else...
Am 19.07.2011 17:58, schrieb George Gemelos:
>
> I'm running an exit node, yreka and have noticed as
> single IP address that has been connected for at least a day, probably
> longer, which is pushing anywhere from 3Mb to 9Mb but receives very
> little traffic back from my node, sub 500Kb. My traffic to this
> machine is going out of 443 (my ORPort) and being sent to port 50090
> on the other machine. I only allow exit traffic to ports 80 and 443.
> So I do not think this is exit traffic. I have also checked on
> blutmagie and could not find the IP as a relay which would suggest
> that this is a TOR user and I am serving as an entry node. I have
> never seen such speeds for a single user.
>
> The one sided nature of the traffic and its size have my interests
> peaked. I just wanted to verify that this is not unusual and
> something that I should investigating. I did not include the IP
> address of the machine because I was not sure it would be in the
> spirit of TOR to post such information. Any feedback would be greatly
> appreciated.
>
>
>
>
>
> _______________________________________________
> tor-relays mailing list
> tor-relays at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
--------------020902030907020209090200
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
From my understanding, this could be someone uploading a large (or
many) files via FTP or something else...<br>
<br>
Am 19.07.2011 17:58, schrieb George Gemelos:
<blockquote
cite="mid:60DC1AE46CEADA4DAC9F09280282AF040430C830 at MBX21.4emm.local"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"> I’m running an exit node,
yreka and have noticed as single IP address that has been
connected for at least a day, probably longer, which is
pushing anywhere from 3Mb to 9Mb but receives very little
traffic back from my node, sub 500Kb. My traffic to this
machine is going out of 443 (my ORPort) and being sent to port
50090 on the other machine. I only allow exit traffic to
ports 80 and 443. So I do not think this is exit traffic. I
have also checked on blutmagie and could not find the IP as a
relay which would suggest that this is a TOR user and I am
serving as an entry node. I have never seen such speeds for a
single user. <o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">The one sided
nature of the traffic and its size have my interests peaked.
I just wanted to verify that this is not unusual and something
that I should investigating. I did not include the IP address
of the machine because I was not sure it would be in the
spirit of TOR to post such information. Any feedback would be
greatly appreciated.<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
tor-relays mailing list
<a class="moz-txt-link-abbreviated" href="mailto:tor-relays at lists.torproject.org">tor-relays at lists.torproject.org</a>
<a class="moz-txt-link-freetext" href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a>
</pre>
</blockquote>
</body>
</html>
--------------020902030907020209090200--
More information about the tor-relays
mailing list