[tor-relays] DirPort DOS activity against Fallback Directories

teor teor2345 at gmail.com
Mon May 21 23:26:32 UTC 2018

On 22 May 2018, at 04:29, Logforme <m7527 at abc.se> wrote:

>> Just looked over a sample of FallBackDir relays in Relay Search and
>> it appears this excess-load abuse is directed at them in particular.
>> Some fall-back directories show more than a month of excess request
>> traffic, presumably on the DirPort.

Have you checked on a relay?

If it's from recent clients, it will be on the ORPort.

If it's from relays or descriptor parsing libraries like stem, it will probably
be on the DirPort.

>> Logs here indicate six weeks
>> of abuse escalating in increments.
> How can I find this information on my relay? (855BC2DABE24C861CD887DB9B2E950424B49FC34)

You can look at your relay's bandwidth graphs on relay search.

> The only weird stuff I've noticed is that memory usage have doubled. From 1.5GB to 3GB. Bandwidth is pegged at times, but not excessively so.

Then it might be harmless.


More information about the tor-relays mailing list