[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-relays] 'relay early' attack detection at the infrastructure level



On 14-08-01 06:58 PM, Nusenu wrote:
> [moved to tor-relays]
> 
> Hi relay ops,
> 
> please consider having a regular look at your logs after upgrading to
> the latest tor releases to spot relay_early attacks (even if the
> attack origin is not directly attributable from a relays point of view).
> 
> searching your logs for
> 'Received an inbound RELAY_EARLY cell'
> should do it.
> 
> https://gitweb.torproject.org/tor.git/commitdiff/68a2e4ca4baa595cc4595a511db11fa7ccbbc8f7

According to

https://blog.torproject.org/blog/tor-security-advisory-relay-early-traffic-confirmation-attack

the RELAY_EARLY cell has common legitimate uses.
How can we distinguish an attack from those?

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays