[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

[tor-relays] ISP thinks a relay is under attack from other relays

To: tor-relays@xxxxxxxxxxxxxxxxxxxx
Subject: [tor-relays] ISP thinks a relay is under attack from other relays
From: Daniel Bryg <fermenthor@xxxxxxxxx>
Date: Tue, 6 Dec 2011 18:17:12 -0500
Delivered-to: archiver@xxxxxxxx
Delivery-date: Tue, 06 Dec 2011 18:17:36 -0500
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; bh=LrKURtc3LT8gnTWCNbTMjl7EjJfnbEJp+K5jf+UShKY=; b=YiY2dxtAlLMegU1IGTzt+ftT7HpMdzZGQXezhPDXLl/qgil3u8GHw8Hl2vf3WRjWcQ 66KTnAj1HqZPzmFi1U3Q95OazR9vJyD8wF4tlbQT0VwbWLrbot0sltq09+74afF9ezBi G4+t2JJVs250ceYOLKWpcvWqvD3/NX/igP+Gg=
List-archive: <http://lists.torproject.org/pipermail/tor-relays>
List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>
List-id: "This mailing list is for support and questions about running Tor relays \(exit, non-exit, bridge\)." <tor-relays.lists.torproject.org>
List-post: <mailto:tor-relays@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>
Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx
Sender: tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx

Hi,

This is mostly just an interesting anecdote but there are also a few questions.

Hetzner informed us (see below) about an attack on our relay (not an exit). It looks like it's just normal traffic from other relays so all is good, but the switch sees incoming activity almost 3x higher than what comes in on the server's interface (90Mbit/s, 13k packets/s). If most of packets are dropped, it must affect the performance of Tor connections.

Is this because the Tor network is overwhelmed with traffic and are all relays subject to much higher requested traffic than their limits?

Thanks,

Daniel.

Direction IN
Threshold Traffic 200 MBit/s
Sum 8,828 GByte/300s (241 MBit/s), 9.436.000 packets/300s (31.453 packets/s), 317 flows/300s (1 flows/s)
External 109.236.85.157, 0,444 GByte/300s (12 MBit/s), 341.000 packets/300s (1.136 packets/s), 1 flows/300s (0 flows/s)
External 93.114.44.37, 0,435 GByte/300s (11 MBit/s), 321.000 packets/300s (1.070 packets/s), 1 flows/300s (0 flows/s)
External 46.165.196.73, 0,373 GByte/300s (10 MBit/s), 287.000 packets/300s (956 packets/s), 1 flows/300s (0 flows/s)
External 91.208.34.12, 0,260 GByte/300s (7 MBit/s), 217.000 packets/300s (723 packets/s), 1 flows/300s (0 flows/s)
External 212.117.161.80, 0,256 GByte/300s (6 MBit/s), 191.000 packets/300s (636 packets/s), 1 flows/300s (0 flows/s)
External 212.26.1.109, 0,241 GByte/300s (6 MBit/s), 363.000 packets/300s (1.210 packets/s), 2 flows/300s (0 flows/s)
External 174.140.167.122, 0,238 GByte/300s (6 MBit/s), 177.000 packets/300s (590 packets/s), 1 flows/300s (0 flows/s)
External 109.163.225.203, 0,182 GByte/300s (4 MBit/s), 142.000 packets/300s (473 packets/s), 1 flows/300s (0 flows/s)
External 94.23.164.42, 0,174 GByte/300s (4 MBit/s), 137.000 packets/300s (456 packets/s), 1 flows/300s (0 flows/s)
External 137.56.163.64, 0,170 GByte/300s (4 MBit/s), 157.000 packets/300s (523 packets/s), 2 flows/300s (0 flows/s)
External 173.254.192.38, 0,166 GByte/300s (4 MBit/s), 143.000 packets/300s (476 packets/s), 1 flows/300s (0 flows/s)
External 188.165.26.254, 0,163 GByte/300s (4 MBit/s), 134.000 packets/300s (446 packets/s), 1 flows/300s (0 flows/s)
External 217.115.137.222, 0,156 GByte/300s (4 MBit/s), 123.000 packets/300s (410 packets/s), 1 flows/300s (0 flows/s)
External 94.23.168.39, 0,149 GByte/300s (4 MBit/s), 133.000 packets/300s (443 packets/s), 1 flows/300s (0 flows/s)
External 216.24.174.245, 0,147 GByte/300s (4 MBit/s), 106.000 packets/300s (353 packets/s), 1 flows/300s (0 flows/s)
External 77.247.181.163, 0,138 GByte/300s (3 MBit/s), 123.000 packets/300s (410 packets/s), 1 flows/300s (0 flows/s)
External 85.214.75.110, 0,137 GByte/300s (3 MBit/s), 117.000 packets/300s (390 packets/s), 1 flows/300s (0 flows/s)
External 204.45.133.189, 0,135 GByte/300s (3 MBit/s), 131.000 packets/300s (436 packets/s), 1 flows/300s (0 flows/s)
External 94.23.174.3, 0,131 GByte/300s (3 MBit/s), 112.000 packets/300s (373 packets/s), 1 flows/300s (0 flows/s)
External 85.31.186.116, 0,130 GByte/300s (3 MBit/s), 104.000 packets/300s (346 packets/s), 1 flows/300s (0 flows/s)
External 178.32.52.72, 0,118 GByte/300s (3 MBit/s), 104.000 packets/300s (346 packets/s), 1 flows/300s (0 flows/s)
External 46.165.196.182, 0,112 GByte/300s (3 MBit/s), 134.000 packets/300s (446 packets/s), 1 flows/300s (0 flows/s)
External 77.247.181.164, 0,106 GByte/300s (2 MBit/s), 89.000 packets/300s (296 packets/s), 1 flows/300s (0 flows/s)
External 77.247.181.162, 0,104 GByte/300s (2 MBit/s), 95.000 packets/300s (316 packets/s), 1 flows/300s (0 flows/s)
External 146.185.23.179, 0,103 GByte/300s (2 MBit/s), 96.000 packets/300s (320 packets/s), 1 flows/300s (0 flows/s)
External 87.98.180.247, 0,101 GByte/300s (2 MBit/s), 95.000 packets/300s (316 packets/s), 1 flows/300s (0 flows/s)
External 199.48.147.35, 0,095 GByte/300s (2 MBit/s), 93.000 packets/300s (310 packets/s), 2 flows/300s (0 flows/s)
External 62.220.136.253, 0,092 GByte/300s (2 MBit/s), 110.000 packets/300s (366 packets/s), 1 flows/300s (0 flows/s)
External 89.248.168.118, 0,092 GByte/300s (2 MBit/s), 79.000 packets/300s (263 packets/s), 1 flows/300s (0 flows/s)
External 199.48.147.45, 0,089 GByte/300s (2 MBit/s), 75.000 packets/300s (250 packets/s), 1 flows/300s (0 flows/s)
External 188.120.245.249, 0,088 GByte/300s (2 MBit/s), 75.000 packets/300s (250 packets/s), 1 flows/300s (0 flows/s)
External 212.95.43.222, 0,087 GByte/300s (2 MBit/s), 72.000 packets/300s (240 packets/s), 1 flows/300s (0 flows/s)
External 74.109.126.29, 0,082 GByte/300s (2 MBit/s), 71.000 packets/300s (236 packets/s), 1 flows/300s (0 flows/s)
External 91.121.166.158, 0,081 GByte/300s (2 MBit/s), 71.000 packets/300s (236 packets/s), 1 flows/300s (0 flows/s)
External 77.247.181.165, 0,079 GByte/300s (2 MBit/s), 80.000 packets/300s (266 packets/s), 1 flows/300s (0 flows/s)
External 146.185.23.180, 0,078 GByte/300s (2 MBit/s), 74.000 packets/300s (246 packets/s), 1 flows/300s (0 flows/s)
External 91.121.85.130, 0,078 GByte/300s (2 MBit/s), 68.000 packets/300s (226 packets/s), 1 flows/300s (0 flows/s)
External 93.182.132.100, 0,075 GByte/300s (2 MBit/s), 65.000 packets/300s (216 packets/s), 2 flows/300s (0 flows/s)
External 46.73.164.123, 0,074 GByte/300s (2 MBit/s), 63.000 packets/300s (210 packets/s), 1 flows/300s (0 flows/s)
External 194.204.30.253, 0,067 GByte/300s (1 MBit/s), 101.000 packets/300s (336 packets/s), 1 flows/300s (0 flows/s)
External 79.172.193.89, 0,065 GByte/300s (1 MBit/s), 58.000 packets/300s (193 packets/s), 1 flows/300s (0 flows/s)
External 62.116.251.71, 0,065 GByte/300s (1 MBit/s), 51.000 packets/300s (170 packets/s), 1 flows/300s (0 flows/s)
External 77.245.18.28, 0,064 GByte/300s (1 MBit/s), 47.000 packets/300s (156 packets/s), 1 flows/300s (0 flows/s)
External 173.254.216.69, 0,064 GByte/300s (1 MBit/s), 60.000 packets/300s (200 packets/s), 1 flows/300s (0 flows/s)
External 188.72.225.172, 0,061 GByte/300s (1 MBit/s), 60.000 packets/300s (200 packets/s), 1 flows/300s (0 flows/s)
External 93.115.241.2, 0,061 GByte/300s (1 MBit/s), 53.000 packets/300s (176 packets/s), 1 flows/300s (0 flows/s)
External 173.254.192.36, 0,059 GByte/300s (1 MBit/s), 50.000 packets/300s (166 packets/s), 1 flows/300s (0 flows/s)
External 188.165.24.70, 0,057 GByte/300s (1 MBit/s), 58.000 packets/300s (193 packets/s), 1 flows/300s (0 flows/s)
External 85.223.49.156, 0,053 GByte/300s (1 MBit/s), 43.000 packets/300s (143 packets/s), 1 flows/300s (0 flows/s)
External 131.130.199.36, 0,052 GByte/300s (1 MBit/s), 45.000 packets/300s (150 packets/s), 1 flows/300s (0 flows/s)

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

Follow-Ups:
- Re: [tor-relays] ISP thinks a relay is under attack from other relays
  - From: Stefan Spühler

Prev by Author: Re: [tor-relays] Abuse complaints about brute forceing via ssh
Next by Author: Re: [tor-relays] Logs full of "eventdns: All nameservers have failed"
Previous by thread: Re: [tor-relays] new (to me, at any rate) message
Next by thread: Re: [tor-relays] ISP thinks a relay is under attack from other relays
Index(es):
- Author
- Thread