[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?

To: tor-relays@xxxxxxxxxxxxxxxxxxxx
Subject: [tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?
From: iji--- via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>
Date: Wed, 09 Sep 2026 15:36:12 -0000
Cc: iji@xxxxxxx
In-reply-to: <29fe5c898089f2fb912afe9cdc23676b@riseup.net>
List-id: "support and questions about running Tor relays (exit, non-exit, bridge)" <tor-relays.lists.torproject.org>
References: <29fe5c898089f2fb912afe9cdc23676b@riseup.net>
Reply-to: "support and questions about running Tor relays (exit, non-exit, bridge)" <tor-relays@xxxxxxxxxxxxxxxxxxxx>
User-agent: HyperKitty on https://lists.torproject.org/

Same here, but in the opposite direction for a middle relay.
The outgoing traffic was around ten times greater than the incoming traffic.
Update to v0.4.9.12 did not help.
No ddos at TCP layer, conn-limit and rate-limit normal.

60-seconds diff of metrics dump for the devs:
-tor_relay_connections_total{type="OR",direction="initiated",state="created",family="ipv4"} 1145
-tor_relay_connections_total{type="OR",direction="initiated",state="created",family="ipv6"} 425
-tor_relay_connections_total{type="OR",direction="received",state="created",family="ipv4"} 3887
-tor_relay_connections_total{type="OR",direction="received",state="created",family="ipv6"} 2505
+tor_relay_connections_total{type="OR",direction="initiated",state="created",family="ipv4"} 1154
+tor_relay_connections_total{type="OR",direction="initiated",state="created",family="ipv6"} 427
+tor_relay_connections_total{type="OR",direction="received",state="created",family="ipv4"} 3889
+tor_relay_connections_total{type="OR",direction="received",state="created",family="ipv6"} 2519
@@ -118 +118 @@
-tor_relay_connections_total{type="Metrics",direction="received",state="created",family="ipv4"} 15
+tor_relay_connections_total{type="Metrics",direction="received",state="created",family="ipv4"} 16
@@ -131 +131 @@
-tor_relay_circ_proto_violation_total 32204
+tor_relay_circ_proto_violation_total 32887
@@ -134 +134 @@
-tor_relay_est_rend_total{action="success"} 54
+tor_relay_est_rend_total{action="success"} 56
@@ -146 +146 @@
-tor_relay_load_onionskins_total{type="ntor",action="processed"} 3087
+tor_relay_load_onionskins_total{type="ntor",action="processed"} 3147
@@ -148 +148 @@
-tor_relay_load_onionskins_total{type="ntor_v3",action="processed"} 158303
+tor_relay_load_onionskins_total{type="ntor_v3",action="processed"} 161425
@@ -155 +155 @@
-tor_relay_intro1_total{action="unknown_service"} 73
+tor_relay_intro1_total{action="unknown_service"} 74
@@ -161 +161 @@
-tor_relay_destroy_cell_total 125358
+tor_relay_destroy_cell_total 127971
@@ -178 +178 @@
-tor_relay_congestion_control_total{state="cc_limits",action="above_delta"} 164303
+tor_relay_congestion_control_total{state="cc_limits",action="above_delta"} 166843
@@ -181,3 +181,3 @@
-tor_relay_congestion_control_total{state="cc_circuits",action="circs_created"} 155254
-tor_relay_congestion_control_total{state="cc_circuits",action="circs_closed"} 149399
-tor_relay_congestion_control_total{state="cc_circuits",action="circs_exited_ss"} 93987
+tor_relay_congestion_control_total{state="cc_circuits",action="circs_created"} 158334
+tor_relay_congestion_control_total{state="cc_circuits",action="circs_closed"} 152560
+tor_relay_congestion_control_total{state="cc_circuits",action="circs_exited_ss"} 95829
@@ -189,2 +189,2 @@
-tor_relay_traffic_bytes{direction="read"} 8492777654
-tor_relay_traffic_bytes{direction="written"} 153599293076
+tor_relay_traffic_bytes{direction="read"} 8685321262
+tor_relay_traffic_bytes{direction="written"} 157162466254
@@ -193,5 +193,5 @@
-tor_relay_congestion_control{state="slow_start_exit",action="cwnd"} 344
-tor_relay_congestion_control{state="slow_start_exit",action="bdp"} 158
-tor_relay_congestion_control{state="slow_start_exit",action="inc"} 31
-tor_relay_congestion_control{state="on_circ_close",action="cwnd"} 296
-tor_relay_congestion_control{state="on_circ_close",action="ss_cwnd"} 243
+tor_relay_congestion_control{state="slow_start_exit",action="cwnd"} 332
+tor_relay_congestion_control{state="slow_start_exit",action="bdp"} 146
+tor_relay_congestion_control{state="slow_start_exit",action="inc"} 30
+tor_relay_congestion_control{state="on_circ_close",action="cwnd"} 287
+tor_relay_congestion_control{state="on_circ_close",action="ss_cwnd"} 247
@@ -200,10 +200,10 @@
-tor_relay_congestion_control{state="cc_backoff",action="chan_blocked_pct"} 75
-tor_relay_congestion_control{state="cc_backoff",action="gamma_drop"} 18
-tor_relay_congestion_control{state="cc_backoff",action="delta_drop"} 13
-tor_relay_congestion_control{state="cc_backoff",action="ss_chan_blocked_pct"} 10
-tor_relay_congestion_control{state="cc_cwnd_update",action="alpha_pct"} 6
-tor_relay_congestion_control{state="cc_cwnd_update",action="beta_pct"} 51
-tor_relay_congestion_control{state="cc_cwnd_update",action="delta_pct"} 0
-tor_relay_congestion_control{state="cc_estimates",action="ss_queue"} 83
-tor_relay_congestion_control{state="cc_estimates",action="queue"} 181
-tor_relay_congestion_control{state="cc_estimates",action="bdp"} 133
+tor_relay_congestion_control{state="cc_backoff",action="chan_blocked_pct"} 76
+tor_relay_congestion_control{state="cc_backoff",action="gamma_drop"} 19
+tor_relay_congestion_control{state="cc_backoff",action="delta_drop"} 12
+tor_relay_congestion_control{state="cc_backoff",action="ss_chan_blocked_pct"} 13
+tor_relay_congestion_control{state="cc_cwnd_update",action="alpha_pct"} 16
+tor_relay_congestion_control{state="cc_cwnd_update",action="beta_pct"} 37
+tor_relay_congestion_control{state="cc_cwnd_update",action="delta_pct"} 1
+tor_relay_congestion_control{state="cc_estimates",action="ss_queue"} 92
+tor_relay_congestion_control{state="cc_estimates",action="queue"} 179
+tor_relay_congestion_control{state="cc_estimates",action="bdp"} 134
@@ -216 +216 @@
-tor_relay_connections{type="OR",direction="initiated",state="opened",family="ipv4"} 808
+tor_relay_connections{type="OR",direction="initiated",state="opened",family="ipv4"} 810
@@ -218,2 +218,2 @@
-tor_relay_connections{type="OR",direction="received",state="opened",family="ipv4"} 251
-tor_relay_connections{type="OR",direction="received",state="opened",family="ipv6"} 1206
+tor_relay_connections{type="OR",direction="received",state="opened",family="ipv4"} 135
+tor_relay_connections{type="OR",direction="received",state="opened",family="ipv6"} 1207
@@ -297 +297 @@
-tor_relay_circuits_total{state="opened"} 5814
+tor_relay_circuits_total{state="opened"} 5722
@@ -300 +300 @@
-tor_relay_load_socket_total{state="opened"} 6705
+tor_relay_load_socket_total{state="opened"} 6701
@@ -305 +305 @@
-tor_relay_streams_total{type="BEGIN_DIR"} 3071513
+tor_relay_streams_total{type="BEGIN_DIR"} 3141550
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx

References:
- [tor-relays] How is this attack causing 900 Mbps download and 100 Mbps upload?
  - From: forest via tor-relays

Prev by Author: [tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?
Next by Author: [tor-relays] Re: Should I switch my guards to exits?
Previous by thread: [tor-relays] How is this attack causing 900 Mbps download and 100 Mbps upload?
Next by thread: [tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?
Index(es):
- Author
- Thread