[tor-relays] Strange Traffic behaviour

Tobias Sachs tobias at tobiassachs.de
Sun Jul 29 20:13:28 UTC 2018


Hi!



> Am 29.07.2018 um 00:51 schrieb Roger Dingledine <arma at mit.edu>:
> 
> On Sat, Jul 28, 2018 at 07:59:08PM +0200, Tobias Sachs wrote:
>> Hibernation is set to 19 TB???s of outgoing Traffic. Hetzner Cloud shows ~16TB outgoing traffic and the relays log itself 38TB.
> 
> Can you give us your actual torrc lines?
> 
Log notice file /var/log/tor/notices.log
RunAsDaemon 1

ORPort 443
ORPort [2a01:4f8:1c1c:af5::1]:443

Nickname GermanCraft3

RelayBandwidthRate 100 MBits
RelayBandwidthBurst 200 MBits

AccountingMax 19TB
AccountingStart month 1 00:00
AccountingRule out

ContactInfo 4096R/0x4cf76925833e2e24 Knight <knight AT germancraft dot net> - 1MTXtuSCCTf6J3TiUnk1ePwgaHt9h6uQaU

DirPort 80

ExitPolicy reject *:*
ExitPolicy reject6 *:*

> Also, how about the log lines, particularly the ones that talk about

> when it woke up, when it went into hibernation, when it plans to wake
> up again, etc?

Jul 29 06:25:01.000 [notice] Configured hibernation.  This interval began at 2018-07-01 00:00:00; the scheduled wake-up time was 2018-07-01 07:27:40; we expect to exhaust our quota for this interval around 2018-07-31 23:32:40; the next interval begins at 2018-08-01 00:00:00 (all times local)

> 
>> vnstat reports exactly 20.38 TiB tx so in conclusion Hetzner can not count there Bits and Bytes or the same as protection is not correct.
> 
> Maybe some of these transmitted bytes went to other Hetzner servers,
> which they don't count as "really" sending bytes to the Internet.
> 
>> Because if Hetzner???s stats are correct i would have send 3 TB???s of Traffic to other Tor servers and clients internally. Because internal traffic is not counted.
> 
> Ah, yes, this is what you suggested. Maybe? That's a lot (a large
> fraction) given that Hetzner doesn't have that large a fraction of the
> Tor network these days.
> 
>> I guess that a Juniper routers net flow tool is correct so how can i look at this? Because my second relay in Helsinki does have this too with a difference of 2 TB???s.
>> 
>> "Heartbeat: Tor's uptime is 27 days 1:39 hours, with 0 circuits open. I've sent 38486.76 GB and received 38489.42 GB. We are currently hibernating.???
>> 
>> When i divide that by two this gives me 19 TB???s of outgoing Traffic. So i guess that this is a bug?
> 
> Tor said you sent 38TB, so that's 38TB of outgoing traffic.
> 
> Maybe your 27 days contained two hibernation periods? That would be
> one possible explanation for 19+19=38.
> 
> —Roger

> Hetzner hosts > 7% of the tor network capacity (#3 on the biggest ASes on the tor network).
> 
> If I know the relays IP I could give you the probabilities of your relay
> relaying traffic to others in the same AS (since a relay will usually not
> be used with others in the same /16 netblock)

So that means the same-as protection is a check that it is not the same /16 Block? That would make sense.

https://bgp.he.net/AS24940#_prefixes <https://bgp.he.net/AS24940#_prefixes>

Hetzner is holding 17 /16 and smaller netblocks. So it is possible that the complete route is within one AS? o.O

The IP is: 159.69.2.239

Thanks for your help!

Tobias


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20180729/2f122f12/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: Message signed with OpenPGP
URL: <http://lists.torproject.org/pipermail/tor-relays/attachments/20180729/2f122f12/attachment-0001.sig>


More information about the tor-relays mailing list