[tor-talk] (D)DOS over Tor network ? Help !

[fuckyouhosting@xxxxxxxxxxxxxxx]

Hi List! We (try to) maintain a free hosting platform for hidden service 
websites, here: http://fuckyouhotwkd3xh.onion
but recently all the hosted hidden services became unreachable.

Tor logs are correctly reporting the problem:

Dec 01 XXX [notice] Your Guard SoylentGreen (XXX) is failing more 
circuits than usual. Most likely this means the Tor network is 
overloaded. Success counts are 147/210. Use counts are 86/86. 147 
circuits completed, 0 were unusable, 1 collapsed, and 1000 timed out. 
For reference, your timeout cutoff is 60 seconds.

Dec 01 XXX [notice] Your Guard regar42 (XXX) is failing more circuits 
than usual. Most likely this means the Tor network is overloaded. 
Success counts are 122/178. Use counts are 91/92. 137 circuits 
completed, 15 were unusable, 0 collapsed, and 17 timed out. For 
reference, your timeout cutoff is 113 seconds.

...

trying to change the Guard, by deleting the /var/lib/tor/state file,
results in the same problem and logs, just with a different Guard.

Trying to host just our hidden service (fuckyouhotwkd3xh.onion),
by deleting all the other hidden services in the torrc file,
'solves' the problem .. logs looks ok and the service is reachable.

It looks like we are hosting an 'offending' hidden service
which is the target of a (D)DOS attack.

We tried to enable Tor debugging and to sniff some traffic
but were unable to find the offending hidden service.

All the access.log and error.log of the hosted websites are ok,
they don't grow in size and don't log any flood.

Even the bandwidth usage of the server looks ok, basically there is no 
traffic.


So .. question: is there a way to understand which hidden service is 
causing all this ?

Suggestions are welcome!

Thank you.
--
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk