Re: [tor-relays] Strange Traffic behaviour

Hi!

Am 29.07.2018 um 00:51 schrieb Roger Dingledine <arma@xxxxxxx>:

On Sat, Jul 28, 2018 at 07:59:08PM +0200, Tobias Sachs wrote:
Hibernation is set to 19 TB???s of outgoing Traffic. Hetzner Cloud shows ~16TB outgoing traffic and the relays log itself 38TB.

Can you give us your actual torrc lines?

Log notice file /var/log/tor/notices.log
RunAsDaemon 1

ORPort 443
ORPort [2a01:4f8:1c1c:af5::1]:443

Nickname GermanCraft3

RelayBandwidthRate 100 MBits
RelayBandwidthBurst 200 MBits

AccountingMax 19TB
AccountingStart month 1 00:00
AccountingRule out

ContactInfo 4096R/0x4cf76925833e2e24 Knight <knight AT germancraft dot net> - 1MTXtuSCCTf6J3TiUnk1ePwgaHt9h6uQaU

DirPort 80

ExitPolicy reject *:*
ExitPolicy reject6 *:*

Also, how about the log lines, particularly the ones that talk about

when it woke up, when it went into hibernation, when it plans to wake
up again, etc?

Jul 29 06:25:01.000 [notice] Configured hibernation. This interval began at 2018-07-01 00:00:00; the scheduled wake-up time was 2018-07-01 07:27:40; we expect to exhaust our quota for this interval around 2018-07-31 23:32:40; the next interval begins at 2018-08-01 00:00:00 (all times local)

vnstat reports exactly 20.38 TiB tx so in conclusion Hetzner can not count there Bits and Bytes or the same as protection is not correct.

Maybe some of these transmitted bytes went to other Hetzner servers,
which they don't count as "really" sending bytes to the Internet.

Because if Hetzner???s stats are correct i would have send 3 TB???s of Traffic to other Tor servers and clients internally. Because internal traffic is not counted.

Ah, yes, this is what you suggested. Maybe? That's a lot (a large
fraction) given that Hetzner doesn't have that large a fraction of the
Tor network these days.

I guess that a Juniper routers net flow tool is correct so how can i look at this? Because my second relay in Helsinki does have this too with a difference of 2 TB???s.

"Heartbeat: Tor's uptime is 27 days 1:39 hours, with 0 circuits open. I've sent 38486.76 GB and received 38489.42 GB. We are currently hibernating.???

When i divide that by two this gives me 19 TB???s of outgoing Traffic. So i guess that this is a bug?

Tor said you sent 38TB, so that's 38TB of outgoing traffic.

Maybe your 27 days contained two hibernation periods? That would be
one possible explanation for 19+19=38.

—Roger

Hetzner hosts > 7% of the tor network capacity (#3 on the biggest ASes on the tor network).

If I know the relays IP I could give you the probabilities of your relay
relaying traffic to others in the same AS (since a relay will usually not
be used with others in the same /16 netblock)

So that means the same-as protection is a check that it is not the same /16 Block? That would make sense.

https://bgp.he.net/AS24940#_prefixes

Hetzner is holding 17 /16 and smaller netblocks. So it is possible that the complete route is within one AS? o.O

The IP is: 159.69.2.239

Thanks for your help!

Tobias