Re: [tor-relays] Sustained large spike in outbound traffic

Re: [tor-relays] Sustained large spike in outbound traffic - what might be going on?

Subject: Re: [tor-relays] Sustained large spike in outbound traffic - what might be going on?

From: Tim Wilson-Brown - teor <teor2345@xxxxxxxxx>

Date: Wed, 30 Dec 2015 10:45:09 +1100

Delivery-date: Tue, 29 Dec 2015 18:45:26 -0500

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:message-id :references:to; bh=R7fPRgiyWX+j8jtswxxXQ9smvMZ8pugsfAy5Z2Uln4g=; b=iZL0WGN6I3b7iXil1IN23G8sUc1duHe762aVRlz8gnsCCnFHx1PovKebyL+pMWfF/w 7qW+qTuDeMmUls/Gin1nLDyKQzW7UbcgoxGfdUiFfYqBae76YKHZfuUEPSFY0vap242G Pvi24TMm8USEewsDU13NZxWStGRrbuyQVobq8HbTmeu+4trRj3aaUk5mxIY6hnXiwI+S +HPpgNzNHQ7azWeHVYEG4wzL7g0356i1ArsgsqGTiBVtpF4DwWMMLF9d87+HOx8rLG7s DblxgON1UQVQgCvE3nlKbPMMtgQS+ErLxD+oCOICQc2XidhalZV/Brr1RwQpS44LW6en 5T1w==

In-reply-to: <5682F8CD.8000708@xxxxxx>

List-archive: <http://lists.torproject.org/pipermail/tor-relays/>

List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>

List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>

List-post: <mailto:tor-relays@lists.torproject.org>

List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>

List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>

References: <477982086.2462679.1451389446683.JavaMail.root@xxxxxxxxxxxxxxxxxxxxxxxxxxx> <1D872389-E444-428D-B1D8-8741FD03FF7F@xxxxxxxxx> <5682F8CD.8000708@xxxxxx>

Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx

Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

On 30 Dec 2015, at 08:19, Toralf FÃrster <toralf.foerster@xxxxxx> wrote:

Signed PGP part
On 12/29/2015 12:53 PM, Tim Wilson-Brown - teor wrote:
>
> I don't know of any other attack or request that amplifies outbound
> traffic via tor or otherwise, but there may be some.

I did experienced too a gap of incoming versus outgoing of about 30% and more few times in the past at an exit relay, having an advertised bandwidth of 8 MB/sec. That gap persists over a day or so and then vanished.

A day is the HSDir rotation period, perhaps there is a popular hidden service which serves 8-30MB/s worth of descriptors.

Tim

Tim Wilson-Brown (teor)

teor2345 at gmail dot com
PGP 968F094B

teor at blah dot im
OTR CAD08081 9755866D 89E2A06F E3558B7F B5A9D14F

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail

_______________________________________________ tor-relays mailing list tor-relays@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays