[tor-relays] DDOS alerts from my provider

To: "Tor relays" <tor-relays@xxxxxxxxxxxxxxxxxxxx>

Subject: [tor-relays] DDOS alerts from my provider

From: "Rafo \(r4fo.com\) via tor-relays" <tor-relays@xxxxxxxxxxxxxxxxxxxx>

Date: Mon, 08 Jul 2024 19:34:51 +0200

Arc-authentication-results: i=1; mx.zohomail.eu; dkim=pass header.i=r4fo.com; spf=pass smtp.mailfrom=admin@xxxxxxxx; dmarc=pass header.from=<admin@xxxxxxxx>

Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.eu; s=zohoarc; t=1720460093; h=Content-Type:Date:Date:From:From:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=r+QZ3oWqLFzA9gfD6A96srcHkJDSyZOijP+TBYBStes=; b=L9WEdn7Bbc58WvHyTyzMpwvy0jIqSXw2RYBPcH/krJ/uwxStUrECnSz0ijjOl1dZ6KFxUSB5s6Vtcw1gPYHZhh4nIr5f0x0XId0jUxS4zWUiRxSSjoEgFl9f9IFptgXkYR3m0QAcpPDIoARkMXmCw7hb7MsXVislaz96OFUky14=

Arc-seal: i=1; a=rsa-sha256; t=1720460093; cv=none; d=zohomail.eu; s=zohoarc; b=erLYzMgHHUm6SPCS5W5Nk6T+DuSxJEotsoPgzX1fw6fQuJPKQkuBbm/47CHcsBfbNsFaIBMHatcKOPPCrcc8/bcJS+8ELj7N9TUlNhTZaEi3TX4E6MMlJT28s0P+YdkaZYc9c1OnGG25r0LYSSiCMhWJjZDckX8qc6BoS/FIPso=

Cc: "Rafo \(r4fo.com\)" <admin@xxxxxxxx>

Delivered-to: archiver@xxxxxxxx

Delivery-date: Tue, 09 Jul 2024 04:55:20 -0400

Dkim-signature: v=1; a=rsa-sha256; c=simple/simple; d=lists.torproject.org; s=2022-eugeni; t=1720515314; bh=pYJUSeOd9qtUHS7++nRsPRbCMWV8ViQ3iA9i052oY+c=; h=Date:To:In-Reply-To:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From:Reply-To:Cc:From; b=nJnnR1LoXbwMKk4UYxcSqv5k3wyduqb0l0f3Vz2ob+ZVCjWZrdzAzBD3+oc3Hr6R7 R/wTqa1mDPLMMTrQt13Dx9VfEWuVYP6bpWOTlFHMNg3BDgW6yqrYKa26aM6UHLdKJu CWR3GDCf/yD/K1MjTdd6C7sM4u7G6WXmqG0cEJSli7/e8jYtRrS/58vYNTSGw/c5l4 SBdF3AAho9kRHkCvjAgPp8j7wCGKdOZ3wLOrOjzgcAYDBAZfOwHx4xLfYUIjzqQlRM wu4BF0fUFr6xQ64SY4vPlTjca02tPQvLeb8cTGbxuc6cWj/9kgL6TIyiirKqzBuR16 oomOvUJ+rgHjw==

In-reply-to:

List-archive: <http://lists.torproject.org/pipermail/tor-relays/>

List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>

List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>

List-post: <mailto:tor-relays@lists.torproject.org>

List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>

List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>

Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx

Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

User-agent: Zoho Mail

Hi,

I have been running a relay for a few months now without any problems. But this week I’ve received 2 DDoS alerts from my provider (Netcup), both are ~3 gigabits. They seem to be coming from other Tor relays.

I’m running an Invidious like instance on my server (which uses around 600 megabits) but I have a 2.5 gigabit port. So I configured my Tor relay to use 300-400 megabits.

I’m not sure where that 3 gigabit of data comes from.

I have lowered my advertised bandwidth to 100 megabits, would that be enough to prevent these kind of issues?

Kind regards,

Rafo

_______________________________________________ tor-relays mailing list tor-relays@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays