[tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?

[kullikovana via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

Hi,  
I run a small non-exit Guard/HSDir relay (FreeBSD, Tor 0.4.9.13).  
A little over a week ago it experienced a clearly abnormal event where outbound traffic became extremely asymmetric and briefly reached several hundred Mbit/s while inbound traffic remained much lower. FreeBSD also logged mbuf/jumbo cluster exhaustion, and Tor eventually stopped.  
This weekend the relay had another strange event. The VPS itself remained running and FreeBSD booted normally. The interface was up and the local provider gateway was reachable, but the host could not reach any external IPv4 address and the public IP/SSH became unreachable. This condition lasted overnight and connectivity returned the following morning without any configuration changes on the relay.  
Unfortunately I did not capture BEGIN_DIR counts or CPU usage before connectivity disappeared, so I cannot say whether this was the same attack, an upstream mitigation/null-route, or an unrelated provider network issue.  
I am posting this mainly because the timing overlaps with the reports of longer 12–24 hour attacks. If it happens again I will try to capture BEGIN_DIR rate, CPU usage, Tor logs and traffic asymmetry before the host becomes unreachable.  
Regards,



Sent with Proton Mail secure email.

On Tuesday, October 6th, 2026 at 10:52 AM, forest via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx> wrote:

> The attack seems to be changing. It's now significantly worse and is
> sustained for 12-24 hours at a time. This needs to be addressed soon.
> 
> Regards,
> forest
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx