[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [tor-relays] DoSer is back, Tor dev's please consider

To: "tor-relays@xxxxxxxxxxxxxxxxxxxx" <tor-relays@xxxxxxxxxxxxxxxxxxxx>
Subject: Re: [tor-relays] DoSer is back, Tor dev's please consider
From: tor <tor@xxxxxxxxxxxxx>
Date: Thu, 22 Mar 2018 23:20:54 -0400
Delivered-to: archiver@xxxxxxxx
Delivery-date: Thu, 22 Mar 2018 23:21:20 -0400
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=anondroid.com; s=protonmail; t=1521775258; bh=gnegUdg5HOVBn2t+UAz+2/8p/lH3nkfmOCm+holIVtQ=; h=Date:To:From:Reply-To:Subject:In-Reply-To:References:Feedback-ID: From; b=e1UWhAPbe8gn30r8XTsa1PdNubD7TAZSV3r1GZz8SlbkbrjcqIwJo6nJsHDBafEkW GzXvTyC2olHXjJJLM4ZVQfXHgsSQHKgyuWX1L/s3KHN8WYNwBUXJZYYOJu9SRzJZxL tYeW2iUWzU+iUP8Wf+YmvZxq2bkY1GQIGwaYjcYI=
Feedback-id: VQdg1G6qp6W3q4fwEzBmXgKoBW84CXOSKS975fQJZbjA-mfLf0M16WneIByukYM6Nd1W0yUYpKCBstegtQsR_w==:Ext:ProtonMail
In-reply-to: <6.2.5.6.2.20180322190859.05744d98@example.org>
List-archive: <http://lists.torproject.org/pipermail/tor-relays/>
List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>
List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>
List-post: <mailto:tor-relays@lists.torproject.org>
List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>
List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>
References: <6.2.5.6.2.20180322190859.05744d98@example.org>
Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx
Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

> Suggestion: DoSCircuitCreationMinConnections=1 be established in consensus


The man page for the above option says:

"Minimum threshold of concurrent connections before a client address can be flagged as executing a circuit creation DoS. In other words, once a client address reaches the circuit rate and has a minimum of NUM concurrent connections, a detection is positive. "0" means use the consensus parameter. If not defined in the consensus, the value is 3. (Default: 0)"

Reading this, I get the impression that lowering the value to 1 would negatively impact clients behind carrier NAT. Isn't that the case? If we only allow 1 concurrent connection per IP, wouldn't that prevent multiple users behind a single IP? I would think the same problem would apply to lowering DoSConnectionMaxConcurrentCount as well (which I think is currently 50 in the consensus, but I've seen suggestions to lower it to 4).

Am I misunderstanding?

_______________________________________________
tor-relays mailing list
tor-relays@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays

Follow-Ups:
- Re: [tor-relays] DoSer is back, Tor dev's please consider
  - From: David Goulet

References:
- [tor-relays] DoSer is back, Tor dev's please consider
  - From: starlight . 2017q4

Prev by Author: Re: [tor-relays] Port not rechable
Next by Author: [tor-relays] Decommissioning (middle) relay
Previous by thread: [tor-relays] DoSer is back, Tor dev's please consider
Next by thread: Re: [tor-relays] DoSer is back, Tor dev's please consider
Index(es):
- Author
- Thread