[tor-relays] Re: Abnormal Firewall-States since 0.4.9.10

[Tor at 1AEO via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

Sharing a hypothesis:

This is likely not the 0.4.9.10 upgrade — your own numbers point that way: the state counts were already elevated in the days before you updated (120–145k, and 190k the day before, against your 20–45k norm).

The timing instead lines up with the network-wide circuit-building DoS wave running since Jun 25 23:00 UTC (the "Circuit-building DoS wave: 20x peak, 8x sustained circuits on guard relays" thread on this list). From Tor's public archives alone: relays signing overload-general climbed from a 2–3% baseline to 12.2% of the network (1,254 relays) on Jul 12, and Running-flag churn roughly tripled — saturated relays failing the directory authorities' reachability probes while still relaying. A full state table is the same failure taken further — nothing new can connect — which would explain a relay dropping off entirely for hours once it hits its state-table max, as reported later in this thread.

On the ~200–250 connections per source address: that would be consistent with Tor's stock defense if that machine runs 4–5 relay instances. DoSConnectionMaxConcurrentCount (consensus default 50) is enforced per tor process, not per host, so N co-hosted relays legally accept 50×N connections from a single source. Worth checking how many relays share that host. We think that per-process enforcement is a real gap — it's one of the changes we've suggested to the Tor Project, with the rest of what we've measured:

* https://1aeo.com/blog/defending-against-circuit-dos-june-2026.html

* Network-wide picture, from public data alone: https://1aeo.com/blog/tor-network-dos-wave-june-2026.html

Attaching two charts from public Tor data about the network that might help frame what's happening broadly.

On Tuesday, July 7th, 2026 at 3:54 PM, ProSecureRelays via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx> wrote:

Hi Zwiebelrouter,

 

interestingly, I saw the same Contabo Adresses, and as you said, they were tor unrelated.

 

However, I thought this might be a “Client” connecting to me, so then it would be a legit connection not coming from a relay.

 

In the same time, I experienced a lot of portscans, I checked my IPS Alarms and two of them where Contabo Adresses.

 

The first scan came from a French Site, the second from Germany. But this might be due to the simple fact, that Contabo has only “EU” as Region, so its kinda random where the rented VPS is started.

 

But maybe there is a specific “enemy” that is using Contabo VPS to try and overwhelm espescially cost effective VPS-Relays, as in their nature there is not much resource headroom for such garbage.

 

I checked the states 5 Minutes ago, and it even got worse, with 225k Open TCP Connections, however my maximum is beyond 2M States.

 

The known attack behind this behavior is state table exhaustion, where your Firewall gets overwhelmed with useless TCP-Connections till there is no state left for legit traffic.

 

I use syncookies for this, meaning if the state table exceeds my threshold, syn-cookies will be used instead of the state table, thus, an overflow should be prevented.

 

Maybe this could be an effective option to protect your relay, it should be possible to implement without additional software on Free-BSD based relays.

 

Or you could increase the size of the state table in exchange for CPU-Time and RAM.

 

Pretty annoying.

 

Thanks for your feedback and best regards,

 

Joker

 

P.S. I just checked a bit further and from the Contabo Subnets, e.g. 13.140.189.0 – 13.140.191.254 alone, more than 100k TCP Connections, but they come from various IPs, I picked four random IPs and none of them were listed as relay.

 

And they had, as you said, about 200 – 250 TCP Connections each, as in your case. Very suspicious..

 

Von: zwiebelrouter via tor-relays [mailto:tor-relays@xxxxxxxxxxxxxxxxxxxx]
Gesendet: Dienstag, 7. Juli 2026 23:20
An: support and questions about running Tor relays (exit, non-exit, bridge)
Cc: ProSecureRelays; zwiebelrouter
Betreff: [tor-relays] Re: Abnormal Firewall-States since 0.4.9.10

 

Hi all,

 

I am observing the same behavior with one of my FreeBSD relays.

All hover around 15k active TCP states according to the pf firewall, except

one, which hovers around 90k TCP states. All run tor version 0.4.9.11.

 

The affected relay's fingerprint is the following:

CE0D31663C7CE954B1944B6D65449963F12BDF78

 

Other things I have observed:

 

At 8 am UTC the CPU usage of the affected relay spiked sharply, while

traffic simultaneously dropped significantly.

 

At around 10:50 am UTC, outgoing Tor traffic dropped to around 5%,

while incoming traffic sharply rised to 135% of normal network traffic.

 

The relay was completely unresponsive up until around 4:22 pm UTC, 

when traffic returned to normal, except for the 6x increase in TCP states.

 

I suppose my relay was hit by some kind of DoS attack?

In the syslog I can see pf firewall entries about hitting max states,

which are at 100.000 concurrent states, which is abnormal.

 

Another thing I've seen is that some other Tor relays have

between 10 to 200 TCP states, even though they only have 1-8

Tor sessions running from their source IP addresses.

 

Strange, but unrelated:

- There hundreds of IPs from the same /24 networks accessing

my Tor relays, all hosted on Contabo, which don't seem to be

Tor Relays, but also don't look look like Tor bridges either (?).

- All of them account to around 6k TCP states, all wit around 50.

 

I don't know what I should to with this information, but maybe

someone finds this interesting.

 

Cheers, ZR

 

On Saturday, July 4th, 2026 at 11:20, ProSecureRelays via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx> wrote:

Hi there,

 

I want to report abnormal Firewall States since the update.

 

Since a week or two, (I believe with 0.4.9.10) tor started to excessively use Firewall-States, far beyond what I observed beforehand.

 

In normal operation, I observed about 20k – 45k Firewall States for the relay.

 

Yesterday, before I installed the update, I had 190k Firewall States, related to Tor Relay Traffic.

 

The days before it cycled from 120 – 145k States. Also far more than normal.

 

Today, I see excessive Errors (> 20 Errors/Sek) in my Firewall, relating to use of invalid Firewall States (pf: BAD State..) – all are Tor Related Connections.

 

It would be nice if anyone could have a look, if your connections increased also that much. I also wonder if this might be a type of attack?

 

Regardless of the odd connections, the relay is running well, no CPU peaks and normal memory usage (602MB).

 

Best regards and have a nice weekend!

 

Joker

 

Attachment: circuit-building-dos-wave-june-2026-chart-network-overload-only.png
Description: PNG image

Attachment: circuit-building-dos-wave-june-2026-chart-network-flap.png
Description: PNG image

Attachment: publickey - tor@1aeo.com - 0x9288289B.asc
Description: application/pgp-keys

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx