[tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?

[Khan Krum via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

Hi,
I run three hobby relays and I seem to be seeing the same behavior on 
one of them. I compared two similar ARM, 2-core, non-exit Guard+HSDir 
relays, both running Tor 0.4.9.13.

On the affected relay I measured 41,240 BEGIN_DIR streams in 61 seconds 
(~676/s). The Tor main thread reaches about 100% CPU, ntor onionskins 
are being dropped, and traffic is strongly asymmetric — roughly 2.2 MB/s 
read vs 7.1 MB/s written.

On my other Guard+HSDir relay, measured at roughly the same time, I saw 
only 148 BEGIN_DIR streams in 60 seconds (~2.5/s). That relay carries 
much more traffic (~15 MB/s in both directions) and appears healthy.

So in my case, simply having the HSDir flag does not seem sufficient to 
trigger the issue. One relay is affected, while another Guard+HSDir 
relay is not.

I’m only a hobby relay operator, so I’m posting these numbers mainly in 
case they are useful for comparison.

Regards,
KhanKrum

_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx