[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: peculiar server "bandwidth" posted by server "mnl" and possible new type of attack
On Tue, 9 Sep 2008 08:48:18 -0600 "Kasimir Gabert" <kasimir.g@xxxxxxxxx>
wrote:
>On Tue, Sep 9, 2008 at 8:10 AM, Olaf Selke <olaf.selke@xxxxxxxxxxxx> wrote:
>> Scott Bennett wrote:
>>>
>>> Nearly 49 MB/s seems a bit of a stretch. The server's operator sent me
>>> a note saying that the server is attached to the 1 GB/s campus backbone net,
>>> but it is attached via a 100 Mb/s router, so the reported data rate is four
>>> to five times the rate physically possible due to the router's limitation.
>>> The server, according to its operator, is running on a 2.6 GHz P4, and its
>>> descriptor says the machine is running LINUX. Based upon postings quite a
>>> while back from blutmagie's operator and from a few other operators of very
>>> high-data-rate servers, it seems to me that a 2.6 GHz P4 (Northwood?) running
>>> LINUX would not be capable of handling a load eight to ten times that of
>>> blutmagie, regardless of its network connection's capacity.
>>
>> blutmagie tor node is running on a pair of the old Prestonia P4 NetBurst Xeon DP
>> 3200MHz processors. Over the last four weeks mrtg monitoring is showing an
>> average interface throughput of 32 MBit/s in and 33 MBit/s out. Throughput is
>> limited by cpu power rather than by available network bandwidth. Since Tor
>> doesn't scale very well with the number of cores, one core is loaded with 100%,
>> leaving the other three cores almost idle. Compiling the openssl library with
>> Intel's C compiler icc improved performance by about 20-25% compared with gcc
>> (compiling tor with icc doesn't change very much). That's the reason blutmagie's
>> observed data rate increased from about 5500 to nearly 7000 KByte/s some weeks ago.
>>
>> regards Olaf
>>
>
>Hello Olaf,
>
>For the upcoming version of TorStatus, I followed Roger's suggestion
>of calculating the observed bandwidth using the read and write history
>instead of the given observed bandwidth rate. After doing this, and
>what seems to follow the graphs relatively accurately, your bandwidth
>rate has dropped to 3463.39 KB/s. I'm using a linear moving average
>to calculate the bandwidth. Would you mind looking over the new
>router detail page and seeing if it looks reasonable to you? You can
>view it at http://trunk.torstatus.kgprog.com/router_detail.php?FP=795513a52e5155af5e36937d5a7c76d3bf20d0c4
>
>Also, with regards to mnl, it is down now but I can remember that when
>it was running I noticed how it was the lead by a large margin on the
>current TorStatus page, but was at something like 200 on the trunk
>page. It seems like it never received the amount of traffic that it
>could handle, or something similar.
>
It appears that mnl was not actually down. It may be experiencing
some network connection problems. Its operator mentioned that he had
been unable to log into it over the weekend, but when he came in on
Monday, it was still running. It had also reappeared on the torstatus
sites.
Anyway, mnl is back, says it has been up 33 days, and is once again
at the very top of torstatus pages when those page entries are sorted
into descending order by "bandwidth". I just sent a note moments ago
to its operator again, this time suggesting that he restart it to get
rid of the bogus numbers. It seems fairly likely that mnl will never
trigger the same bug again anyway.
Scott Bennett, Comm. ASMELG, CFIAG
**********************************************************************
* Internet: bennett at cs.niu.edu *
*--------------------------------------------------------------------*
* "A well regulated and disciplined militia, is at all times a good *
* objection to the introduction of that bane of all free governments *
* -- a standing army." *
* -- Gov. John Hancock, New York Journal, 28 January 1790 *
**********************************************************************