[tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?

[iji--- via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

> Does anyone have any advice? This attack seems to be getting worse.

This metric may reveal the attack vector.
-tor_relay_streams_total{type="BEGIN_DIR"} 3071513
+tor_relay_streams_total{type="BEGIN_DIR"} 3141550

~70000 "BEGIN_DIR" within one minute on single non-exit guard relay, normal ~300 "BEGIN_DIR".

What about enabling "DoSStreamCreationEnabled" ?
The default setting is 'auto', but it appears that there is no consensus, so it is currently disabled by default.
The disabled state is also confirmed by the heartbeat log line.
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx