[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-relays] blocking >1 connections per ip address onto Tor DirPort

The “normal” classification of DDOS is more than 250000 packets/sec to your server/vps. 

You could check if it is a smurf attack or x-mas or whatever, but normally you will be null routed with 250k+ or the (hopefully) good anti DDOS hardware of the ISP will kick in.

Markus

“Cheery was aware that Commander Vimes didn't like the phrase 'The innocent have nothing to fear', believing the innocent had everything to fear, mostly from the guilty but in the longer term even more from those who say things like 'The innocent have nothing to fear'.”

― Terry Pratchett, Snuff

On 16. Aug 2017, at 01:16, eric gisse <jowr.pi@xxxxxxxxx> wrote:

Just out of curiosity, do DoS attacks against dirports even happen?

My server gets nailed by what my host thinks is a DOS every now and
then but I'm yet to get details.

Does anyone have a good idea on how I would be able to classify
traffic as an attack rather than normal "shitloads of traffic" ?

On Tue, Aug 15, 2017 at 5:22 PM, Roger Dingledine <arma@xxxxxxx> wrote:
On Tue, Aug 15, 2017 at 11:52:31PM +0200, Toralf Förster wrote:
Does a particular Tor server/client will open more than 1 connection
at a time from to the DirPort ?

I think we definitely want to support that in the protocol.

I'm not sure whether it happens right now, but it might.

But preventing it from happening is likely bad.

Note that most clients use the ORPort for fetching directory stuff,
and that's heading towards "all clients" as people upgrade and stop
using weird configurations. So the DirPort is mainly used on authorities
(by relays that fetch dir stuff or upload relay descriptors), and by
auxiliary tools like stem and the various metrics project scripts.

If you're worried about denial of service issues on the DirPort, maybe
the simple answer is to turn off the DirPort? I think the only real
impact might have something to do with whether old clients believe that
you're a usable guard.

--Roger

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays
_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays