[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #30636 [Metrics/Analysis]: Something funky is going in Iran: numbers of relay users flies off to 1M+
#30636: Something funky is going in Iran: numbers of relay users flies off to 1M+
------------------------------+------------------------------
Reporter: cypherpunks | Owner: metrics-team
Type: task | Status: new
Priority: Medium | Milestone:
Component: Metrics/Analysis | Version:
Severity: Normal | Resolution:
Keywords: ir | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
------------------------------+------------------------------
Old description:
> [[Image(userstats-relay-country-ir-2019-03-01-2019-06-11-off.png,600px)]]
> [https://metrics.torproject.org/userstats-relay-
> country.html?start=2019-03-01&end=2019-06-11&country=ir link]
>
> [[Image(userstats-bridge-country-ir-2019-03-01-2019-06-11.png,600px)]]
> [https://metrics.torproject.org/userstats-bridge-
> country.html?start=2019-03-01&end=2019-06-11&country=ir link]
>
> [[Image(userstats-bridge-combined-ir-2019-03-01-2019-06-11.png,600px)]]
> [https://metrics.torproject.org/userstats-bridge-
> combined.html?start=2019-03-01&end=2019-06-11&country=ir link]
New description:
[[Image(userstats-relay-country-ir-2019-04-01-2019-09-03-off.png,600px)]]
[https://metrics.torproject.org/userstats-relay-
country.html?start=2019-04-01&end=2019-09-03&country=ir link]
[[Image(userstats-bridge-country-ir-2019-04-01-2019-09-03.png,600px)]]
[https://metrics.torproject.org/userstats-bridge-
country.html?start=2019-04-01&end=2019-09-03&country=ir link]
[[Image(userstats-bridge-combined-ir-2019-04-01-2019-09-03.png,600px)]]
[https://metrics.torproject.org/userstats-bridge-
combined.html?start=2019-04-01&end=2019-09-03&country=ir link]
--
Comment (by dcf):
Replying to [comment:32 xhdix]:
> and again..
> The ability to connect directly to Tor was blocked, and it was blocked
through the list of IPs in the collector.
How do you know that it was blocked using the CollecTor?
> It looks like an app (probably an unofficial telegram) uses <OR>. (Due
to a sharp increase and decrease)
In the recent past, I've seen two large but brief spikes of users from IP
addresses located in Iran, on two of my vanilla bridges. (In the second
case, the bridge is actually supposed to be a meek bridge, but the Iranian
IP addresses were connecting to one of its exposed ORPorts.)
It would be an interesting experiment to go through CollecTor data and see
if any other bridges have experienced spikes like this. A hypothesis is
that a Telegram app, or whatever it is, chooses one bridge to use for a
day, then changes to another one. If that were the case, we would be able
to identify spikes rolling temporally across multiple bridges.
https://metrics.torproject.org/rs.html#details/272EB44C8992B8088BD8E8A12DB23B56478EB885
[[Image(history-eRYaZuvY02FpExln-20190903.png)]]
https://metrics.torproject.org/rs.html#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8A34
[[Image(history-starman-20190903.png)]]
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30636#comment:33>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs