[tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?

[khankrum359--- via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

Hi all,
A small update from my side.

After observing the same phenomenon on more than one of my relays, I wanted a way to capture it continuously instead of trying to collect diagnostics only after the relay was already overloaded.

I have therefore put together a small passive monitoring tool:

Tor BEGIN_DIR Storm Sentinel

https://github.com/YankoNach/tor-begindir-sentinel

The tool only reads Tor's local MetricsPort and Linux /proc. It does not use the ControlPort and does not change, reload, restart, throttle, or otherwise modify Tor.

In my own observations, the first obvious operator-visible symptom was the same one described earlier in this thread: sudden and extreme traffic asymmetry on a relay whose traffic is normally much more balanced.

The most useful specific indicator I found in the metrics was BEGIN_DIR. During normal operation it stays very low, but during the abnormal periods I observed it rising to hundreds, and in some samples more than a thousand, per second. This is consistent with iji's earlier observation in this thread of about 70,000 BEGIN_DIR streams in one minute compared with about 300 normally.

One of my relays, for example, was recording roughly 688–764 BEGIN_DIR/s while traffic was strongly asymmetric. Without a Tor restart or PID change, the phenomenon then disappeared abruptly: BEGIN_DIR fell to about 1/s and read/write traffic became almost symmetric again. I have included this transition as an example in the repository README. 

The Sentinel records BEGIN_DIR/s, read/write traffic and asymmetry ratio, Tor total and main-thread CPU, circuits, sockets, ntor/ntor_v3 processing and drops, Guard/HSDir flags, and the Tor PID. It samples every 30 seconds normally and every 10 seconds when suspicious activity is detected, and saves raw MetricsPort snapshots around interesting transitions.

I am deliberately calling this a "BEGIN_DIR storm" rather than an attack. The measurements show a very unusual workload and a strong correlation, but they do not establish intent or prove the underlying cause.

One experiment I have not yet reproduced myself under controlled monitoring is the DirCache 0 behaviour described earlier in this thread, where the dominant traffic direction appears to reverse. forest reported this in the original September discussion. If one of my relays enters another storm, I intend to capture a stable baseline first and then test DirCache 0 without restarting Tor while the Sentinel records the transition.

If other relay operators experiencing the same phenomenon want to run the monitor as well, comparable captures from several relays might help determine whether we are all seeing the same underlying behaviour.

Feedback from Tor developers or relay operators on the metrics, thresholds, or anything else worth recording would be very welcome.

Regards,
Khan Krum
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx