[tor-relays] huge increase in relay traffic

Richard Budd rotorbudd at gmail.com
Sat Aug 31 19:19:49 UTC 2013


I've been following your Pi thread, and up until yesterday I've haven't
seen any problems at all on mine. Of course it's only running 2 meg
bandwidth total. So I thought that might be the difference.
Then last night my router (Asus Asus RT-N66U running Shibby Tomato) became
very sluggish. Log showed pages of    "Tomato user.warn kernel:
nf_conntrack: table full, dropping packet" So I increased Max Connections
and Hash Table sizes by about 50% and that has seemed to relieve the router
problems.
Top shows Tor using 60 to 80% CPU. But it's not doing anything else so I'll
let it run till it gives up. (it's been running for over 70 days)


On Sat, Aug 31, 2013 at 2:20 PM, Gordon Morehouse <gordon at morehouse.me>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Richard Budd:
> > I'm seeing the same on all 5 of my non-exit nodes, they are spread
> > around the US and EU. It seems that they all are running at close
> > to max bandwith for the last several days also.
>
> My guess is whoever is running the DDOS[1] figured out that they can
> most cheaply disrupt the Tor network by creating bogus circuits (and
> eventually causing relays to run out of RAM and/or CPU) rather than
> sending reams of bogus data through.
>
> Whether that's true or not, my experiments with Raspberry Pi relays
> provide sort of a 'canary in the coal mine' - enough circuits and tor
> *will* consume all available RAM and be killed, as happened finally to
> me sometime in the wee hours here.
>
> [1] I presume it's a DDOS because a) come on; b) look at the graph of
>     clients connecting from Vietnam.  ~0 to ~5000 in a week or two?
>     Yeah right.
>
> Best,
> - -Gordon M.
>
>
> -----BEGIN PGP SIGNATURE-----
>
> iQEcBAEBCgAGBQJSIjPeAAoJED/jpRoe7/ujuUsIAKRCXz51z+/5MRywfYA48ySi
> 4325YqSdjzl8mhDKmpOOohhUTMTkCPJvDsD4BC8JyoaEk4cDDdsKMOwPUx2szvAr
> Vhkh7rwMqYuDR/nkH+E2w9CVPFgo8BeVbuRSuewX/vvVE4nAS1m4ULB3ffA3EYko
> dC9kFN9vf1uFb8lMGu6rVAULm6f8kzWYMGZ0uaWat6qQ4x45kWLxt8Y3caHESk3U
> 2tpLLAOLT7nhqGC1ALNOEm3gmox1xRFQM1vaYUdpIGb4hhkRKtHEXj+J00Mp0sPH
> f4QQhPv+nUbEKamJD45MItU34Iv6zjTJVx9TP5ZkZ1qpa835YsknXaSXpjUe0Yg=
> =UjmG
> -----END PGP SIGNATURE-----
> _______________________________________________
> tor-relays mailing list
> tor-relays at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20130831/3ec245a2/attachment-0001.html>


More information about the tor-relays mailing list