[tor-relays] adaption of a DDoS prevention solution (now with images)

[Toralf Förster via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

    Recent DDoS attacks caused me to update the DDoS solution [1] and to
    roll it out to Tor instances using [2].
    
    
    The metrics below shows the effect for the (highly overloaded vCPU
    before), the throughput and the amount of protocol violations of a
    tiny Tor cloud instance:

    Another example is Tor instance at a bare metal server, attacked
    between
    12 and 13 UTC (no Tor metrics during that time) and again after 16 UTC.
    
    The new rule set was developed between 14 and 15, and fully applies
    after a reboot at 15:20:

    The graph below shows that the ipset (which holds malicious ip
    addresses to be blocked) was not updated at 12 UTC.
    But with the new rule set in place it was updated soon at 16 UTCk.

    The green line here is the (now first half) of the changed rule
    whilst the yellow line reflects the addition for that rule.

    And finally a graph of the DOS Tor metric for this instance which
    shows that the Tor process has much less DOS to handle than before:

    I'm still fine tuning the solution.
    
    
    
    [1] https://github.com/toralf/torutils#the-rule-set
    
    [2] https://github.com/toralf/tor-relays

-- 
Toralf

Attachment: OpenPGP_0xC4EACDDE0076E94E.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature

_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx