Hi! David Fifield via tor-relays:
While I don't speak for relay operators I think there are three points worth making in that regard:When your relays are experiencing a BEGIN_DIR flood, does it also affect their user count metrics? For example, in the "average number of connected clients" graph at https://metrics.torproject.org/rs.html. User count metrics come from counting directory requests (the "dirreq-v3-resp" line in metrics descriptors). https://metrics.torproject.org/reproducible-metrics.html#relay-users In August and September 2026, there have been unusual, temporary, apparent increases in users of one of the two Snowflake bridges: just snowflake-01, not snowflake-02. The country geolocation is "??", which usually means the Snowflake proxy (or whatever is acting in the role of a Snowflake proxy and connecting directly to the bridge's WebSocket port) does not send a client IP address. See discussion and graphs: https://lists.torproject.org/mailman3/hyperkitty/list/anti-censorship-team@xxxxxxxxxxxxxxxxxxxx/thread/L2XI56NB4GLNG4VFF6VARA64RJBW54OD/ https://opencollective.com/censorship-circumvention/projects/snowflake-daily-operations/updates/2026-august-update https://opencollective.com/censorship-circumvention/projects/snowflake-daily-operations/updates/2026-september-update A BEGIN_DIR attack could explain the apparent increases in users, because it is directory requests that are counted to estimate user counts. I'm curious if relay operators who have experienced a BEGIN_DIR attack have also seen apparent increases in user counts.
1. The BEGIN_DIR attack is targeting relays that have the HSDir flag as far as we know. Which means that if you would not have that flag you would not get hit by the flood.
2. As dgoulet pointed out in his email explaining the new DoS defenses[1] there are multiple new knobs and MetricsPort metrics available. The one we saw getting triggered yesterday was begindir_hsdir_rejected. So, fetching/uploading onion service descriptors is definitely one of the attack modes in the BEGIN_DIR flooding and I think those would not change user count metrics.
3. In case you wonder about the user count/bridge count spikes starting with 2026-10-28, those are very likely unrelated to the BEGIN_DIR flood. Rather, they seem to stem from prohibiting pre 0.4.9.x clients[2].
So, in particular 1. and, with low confidence, 2. make me skeptical that the BEGIN_DIR flood is relevant in your context.
Georg[1] https://lists.torproject.org/mailman3/hyperkitty/list/tor-relays@xxxxxxxxxxxxxxxxxxxx/thread/DO63TMBKGPNCUG2UBNBZ6PSJOXMP4VM4/ [2] See: https://gitlab.torproject.org/tpo/network-health/analysis/-/work_items/116 for details.
Attachment:
OpenPGP_signature.asc
Description: OpenPGP digital signature
_______________________________________________ tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx