Re: another unusual connection

["john smith" <d1nqf0s4vg9wk5ilq@xxxxxxxxx>]

greetings!

same sequence of events, same IP address. my relay had been running
for just under 5 days. no other activity on the connection or on the
box running the relay.


Feb 02 17:16:49.093 [Notice] Our IP Address has changed from
87.194.38.72 to 212.112.242.159; rebuilding descriptor.

Feb 02 17:16:51.061 [Notice] Self-testing indicates your ORPort is
reachable from the outside. Excellent. Publishing server descriptor.

Feb 02 17:16:51.139 [Notice] Our IP Address has changed from
212.112.242.159 to 87.194.38.72; rebuilding descriptor.

Feb 02 17:17:11.061 [Notice] Self-testing indicates your ORPort is
reachable from the outside. Excellent. Publishing server descriptor.

Feb 02 17:17:40.030 [Notice] Performing bandwidth self-test...done.

regards,

john smith



On 1/28/08, john smith <d1nqf0s4vg9wk5ilq@xxxxxxxxx> wrote:
> on Mon, Jan 28, 2008 at 3:33 AM Roger Dingledine wrote:
>
> > Neat. So it was 212.112.242.159 in both cases?
>
> yes
>
> > Please let me know if it happens more (or if other people experience it
> > and can provide more details!), and maybe we'll narrow in further.
>
> will do. if there's anything i can do to provide you with more
> detailed/specific information then let me know & i will endeavour to
> do so.
>
> regards,
>
> john smith
>
> On 1/28/08, Roger Dingledine <arma@xxxxxxx> wrote:
> > On Sun, Jan 27, 2008 at 10:42:14PM +0000, john smith wrote:
> > > another recurrence of the same type of unusual connection.
> > > i include the time the server started in the log below. the connection
> > > through 212.112.242.159 persists for a much longer period of time on
> > > this occassion (the 'scrubbed' connection did not occur last time).
> >
> > Neat. So it was 212.112.242.159 in both cases?
> >
> > New theory: in rare cases, Tor servers (like maximator) lie to directory
> > clients about what IP address they appear to have, due to iptables
> > confusion or something similar. More specifically, it claims that
> > everybody looks like itself. Then Tor servers that don't know their own
> > address get suckered into thinking they switched.
> >
> > If this is actually the bug, I'll have to ponder how to fix it well. We
> > could require several places to agree before we think we should switch;
> > but that would slow down reaction times considerably. We could only
> > believe answers from authorities; but I don't want to preclude better
> > load balancing. We could ignore it when we ask a directory mirror at IP
> > address X and he says we look like we're coming from IP address X;
> > that's probably a good idea, and I should add a check for this. Then we
> > can see if that check ever triggers.
> >
> > Please let me know if it happens more (or if other people experience it
> > and can provide more details!), and maybe we'll narrow in further.
> >
> > Thanks,
> > --Roger
> >
> >
>