[tor-relays] Re: How is this attack causing 900 Mbps download and 100 Mbps upload?

[via tor-relays <tor-relays@xxxxxxxxxxxxxxxxxxxx>]

I have some measurements from my affected relay (non-exit) that may or may not help.

The relay received the HSDir flag in the early hours of October 8.

At 12:34 UTC on October 8, the relay began receiving around 1,940 BEGIN_DIR requests per second. Its upload bandwidth immediately hit the set RelayBandwidthRate limit of 100 MiB/s, while the main thread was using around 40% of a single core. The circuit count remained relatively normal at around 13,000–17,000, and memory usage stayed at a couple of gigabytes. This "stable" stage continued for around 22.5 hours.

During this time I briefly experimented with changing RelayBandwidthRate from 100 MiB/s to 105 MiB/s and back. The observed BEGIN_DIR rate increased from approximately 1,940/s to 2,050/s at the higher limit, then returned to around 1,940/s after I restored the original limit. The write bandwidth correlates proportionally with the number of BEGIN_DIR requests as long as the CPU can manage it.

At exactly 11:00 UTC on October 9, the attack escalated:

BEGIN_DIR started climbing towards 4,100 requests/s.
The circuit count rose to almost 80,000.
Main-thread CPU usage reached 100%.
Onionskin processing increased to over 800/s, compared with roughly 20/s before the attack.
Tor's memory usage climbed to approximately 12 GB.
The resource usage peaked at 11:58 UTC, October 9, then started descending.

The incident stopped completely at 13:34 UTC. CPU usage, bandwidth, circuit count and other monitored metrics returned to normal but memory usage remains at around 12 GB. The relay is still running and I will keep monitoring it to catch the next attack window. The relay was responsive during the whole attack.
_______________________________________________
tor-relays mailing list -- tor-relays@xxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to tor-relays-leave@xxxxxxxxxxxxxxxxxxxx