So much fun. Sent with Proton Mail secure email. On Sunday, September 27th, 2026 at 8:35 PM, kullikovana <kullikovana@xxxxxxxxx> wrote: > I observed what appears to be a very similar traffic pattern today on a FreeBSD 15.1 Tor relay in Finland. > The relay normally has fairly symmetric RX/TX traffic, but suddenly became extremely asymmetric and bursty. During one ~6 minute sample, RX averaged 13.9 Mbps while TX averaged 101.4 Mbps, with TX peaking at 348.8 Mbps. At times RX dropped close to zero while TX remained very high. > During the event, Tor CPU usage increased significantly and SSH repeatedly became unresponsive. The FreeBSD kernel started reporting: > kern.ipc.nmbjumbop limit reached > kern.ipc.nmbclusters limit reached > After Tor eventually stopped running, the VPS itself was still up (no reboot). netstat -m showed: > 1522690/0/0 requests for jumbo clusters denied (4k/9k/16k) > I restarted Tor after the system recovered, and the abnormal traffic pattern immediately returned. I have now stopped Tor temporarily. > The relay is a non-exit relay and only recently received the Guard flag. I cannot confirm that this is the same attack discussed in this thread, but the asymmetric traffic and resulting resource exhaustion seem very similar. > > > > Sent with Proton Mail secure email. > > On Wednesday, September 23rd, 2026 at 5:51 AM, forest via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx> wrote: > > > I've noticed odd attack behavior when setting DirCache 0 in the middle > > of an attack. As mentioned previously, doing that causes the attack to > > switch from causing massive outbound traffic to massive inbound traffic, > > although with less effect on CPU load. But this attack has some unique > > patterns: It alternates between a "pulsing" phase that lasts 15+ minutes > > and a "steady" phase that lasts about 3 minutes. When pulsing, traffic > > comes in bursts every 3-5 seconds at over 1 Gbps peak. When steady, it > > seems to be causing the relay to receive 400-600 Mbps. > > > > I wonder if the "steady" phase is trying to measure the effect of the > > "pulsing" phase or something. > > > > No idea if this also happens when DirCache 1 however. > > > > Regards, > > forest
Attachment:
image.png
Description: PNG image
_______________________________________________ tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx
