[tor-relays] Permissible traffic volume log density

[Andreas Krey]

On Tue, 23 Oct 2012 20:32:25 +0000, admin wrote:
...
>  > I do similar, but I run a simple cronjob around ifconfig. :-) Also for 
>  > seeing the total traffic consumption on my relays (and my home DSL). 
>  > I then feed that into gnuplot for some graphs for me to see; and 
>  > the interplay of RelayBandwithRate and RelayBandwidthBurst ist 
>  > pretty plain to see in there. 
>  > 
> Nice approach. Would you mind sharing your fingerprint/nickname? I'd love to look at it with Atlas.

Atlas is too coarse to see that... or rather it looks like it doesn't
believe in traffic that exceed the advertized bandwidth:

http://atlas.torproject.org/?#details/26220AEA188B8D0E47BB541E1A616EB3AD70295F

My graphs look like (not the near realtime one; just a sample):

http://ch.iocl.org/tor/relay.png

There you have the overruns and the following flatline in traffic
as long as the 'Burst' is consumed.

For comparison, my home dsl, where another relay does a burst
(the part where out is half of in+out0:

http://ch.iocl.org/tor/dsl.png

(I also do plots of volume over time.)

...
> Ok, to be brutally honest, I'm obviously too naive at the moment to understand the actual issue thoroughly. Are you referring to some opportunity to draw conclusions about specific Tor users and effectively track/"uncover" them?

Yes; although it's probably too little data indeed as long as you don't
know where it's going; and most relays (esp. the exits) are too busy
to produce discernible patterns this way.

...
> We use the stats for a better understanding of total traffic, especially over time (e.g. I already noticed that there are some adjustments to the config needed for daily accounting/bandwidthrate/-burst for our higher bw relays utilizing these very traffic stats - as it seems, while the higher bw relays are blowing traffic out the door like crazy ;-), especially asurahosting1, the lower bw relays, e.g. tailoredvps1, do not even utilize the accounting to its full potential without a slightly higher bw_adv)

Indeed. Q is mostly burning its assigned bandwidth (and I wouldn't like
to have circuits through it while it is in 'flatline'), while the
home relay only sees occasional downloads (flat bursts), and the
bridges hardly have any traffic.

Andreas

-- 
"Totally trivial. Famous last words."
From: Linus Torvalds <torvalds@*.org>
Date: Fri, 22 Jan 2010 07:29:21 -0800