[tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?

[kullikovana via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

I observed what appears to be a very similar traffic pattern today on a FreeBSD 15.1 Tor relay in Finland.
The relay normally has fairly symmetric RX/TX traffic, but suddenly became extremely asymmetric and bursty. During one ~6 minute sample, RX averaged 13.9 Mbps while TX averaged 101.4 Mbps, with TX peaking at 348.8 Mbps. At times RX dropped close to zero while TX remained very high.
During the event, Tor CPU usage increased significantly and SSH repeatedly became unresponsive. The FreeBSD kernel started reporting:
kern.ipc.nmbjumbop limit reached
kern.ipc.nmbclusters limit reached
After Tor eventually stopped running, the VPS itself was still up (no reboot). netstat -m showed:
1522690/0/0 requests for jumbo clusters denied (4k/9k/16k)
I restarted Tor after the system recovered, and the abnormal traffic pattern immediately returned. I have now stopped Tor temporarily.
The relay is a non-exit relay and only recently received the Guard flag. I cannot confirm that this is the same attack discussed in this thread, but the asymmetric traffic and resulting resource exhaustion seem very similar.



Sent with Proton Mail secure email.

On Wednesday, September 23rd, 2026 at 5:51 AM, forest via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx> wrote:

> I've noticed odd attack behavior when setting DirCache 0 in the middle
> of an attack. As mentioned previously, doing that causes the attack to
> switch from causing massive outbound traffic to massive inbound traffic,
> although with less effect on CPU load. But this attack has some unique
> patterns: It alternates between a "pulsing" phase that lasts 15+ minutes
> and a "steady" phase that lasts about 3 minutes. When pulsing, traffic
> comes in bursts every 3-5 seconds at over 1 Gbps peak. When steady, it
> seems to be causing the relay to receive 400-600 Mbps.
> 
> I wonder if the "steady" phase is trying to measure the effect of the
> "pulsing" phase or something.
> 
> No idea if this also happens when DirCache 1 however.
> 
> Regards,
> forest
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx