[tor-relays] Re: reply to: 5 to 10 times more outgoing than incoming traffic

[Chappie via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

A simple mitigation I used while my relay was under attack was the following. After noticing the unusual traffic, I enabled the option shown in [1] and then reloaded the affected Tor instance using the command in [2]. I left the instance in this state for approximately five minutes.

Immediately after the reload, the abnormal traffic stopped. I then commented out the option shown in [1] in the torrc configuration file and reloaded the instance once again using the command in [2]. In this way, the attack was effectively interrupted.

During this short interval of approximately ten minutes, my relay did not lose any of its flags. It appears that the attack tool was unable to determine that it should resume targeting the relay after the temporary interruption.

[1]

DirCache 0

[2]

systemctl reload tor@relay2.service
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx