[tor-relays] Sustained large spike in outbound traffic

[tor-relays] Sustained large spike in outbound traffic - what might be going on?

Subject: [tor-relays] Sustained large spike in outbound traffic - what might be going on?

From: David Tomic <david@xxxxxxxxxxxx>

Date: Wed, 23 Dec 2015 19:32:36 +1100

Delivery-date: Wed, 23 Dec 2015 03:32:52 -0500

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:date:message-id:subject:from:to:content-type; bh=Md0OpvANfwUC42JdYy4ByiKEXgD/2ZY13YX9EYYRomQ=; b=cS8Iju4lKFW1NZyUQuJH3ObZ4y5d7LCv3thuyGTvDWDWW/aYnJBUOT1mgE0TwPPez0 dd700MgA6Cag/YR9jadYhgfo1v0S3aOjzJpJEByW27Fuo6iZECNpGMvNu1o2xAXv1L1B ig5My8Za1Uh3/2dyDcUxxMz4aLICfFKVS2sumsjV4pghamAHnoOW+d0ULcj2utUdumvM 3O9uzZXeSGTmPU3XoN9/3p5JT0MDZr9wmTO3nLUK99iCyR9vaZc7wYmKqRDte6GDZchj X2B9UcQYxFHpwc1Le2P18gituQtoLXheMe60GBeQTVLpIgdch4LnsDxF02YnG2ciVv4l 3bCA==

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tomic-com-au.20150623.gappssmtp.com; s=20150623; h=mime-version:sender:date:message-id:subject:from:to:content-type; bh=Md0OpvANfwUC42JdYy4ByiKEXgD/2ZY13YX9EYYRomQ=; b=QiOJJ2vmuF6nAMDtgD/qYtD5/Eyowa19HN6VRhdwqR1/dYsnZhicC3+SPF/5+QKuNx jqvDhJ47Pm0Di+7b7DVjiwqwciwF1wnnDhiw5wxwcVkBGWp9v6VNWTVK5f00kkYWR2Nf O8+d7Ub33Qraty6iilzl1vPQAmBhe8JuczbWtoHUfh/4c20c7usX85uO8aeN8omPpA1M lVimxF/1yDoyAYWn90XZDCeKhGOaqL4EzI1z7D7+vYs/leUfbKgUZPXVo2aSRGzDiA+O k/6MOzcsrj2C1BTE8Bs9VwEoKWZHrlYDoqDSOFJOrQiJpMn8MDz/wEdPvMad3FcIBrpr qbvA==

List-archive: <http://lists.torproject.org/pipermail/tor-relays/>

List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>

List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>

List-post: <mailto:tor-relays@lists.torproject.org>

List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>

List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>

Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx

Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

Hello everyone,

I noticed something a little bit "odd" on one of my exit relays recently, and I just wanted to ask whether anybody might be able to account for what was actually happening, and whether it's likely to warrant any further investigation?

TLDR; I noticed a fairly significant spike - in excess of 30MB/s (yes, megabytes) - of outbound traffic compared to inbound. Â

http://s2.postimg.org/cvfzqvrsp/graph.png

It persisted steadily for just over an hour, until I noticed what was going on and restarted Tor (not the whole server, only Tor), at which point my traffic appeared to return to normal again.

I have this relay running a a dedicated machine, with multiple physical NICs, and the ONLY thing which should be touching this NIC is my Tor traffic.

Thoughts?Â

_______________________________________________ tor-relays mailing list tor-relays@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays