Re: peculiar server "bandwidth" posted by server "mnl" and possible new type of attack

[Roger Dingledine <arma@xxxxxxx>]

On Wed, Sep 10, 2008 at 03:09:35PM +0200, Domenico Andreoli wrote:
> Due to other reasons this morning it was offline and I've been unable
> to mail too. I am recovering a couple of messages I sent yesterday on
> this ml which have been dropped becaouse (I guess) wrote them with the
> wrong From email address.
> 
> I put online the logs of the last few days:
> 
>   https://mnl.crema.unimi.it/~cavok/tor/ 

This explains it. grep the logs for "consensus":

Sep 08 06:41:43.220 [warn] Our clock is 5 hours, 19 minutes behind the time published in the consensus network status document (2008-09-08 10:00:00 GMT).  Tor needs an accurate clock to work correctly. Please check your time and date settings!

Sep 08 07:28:28.888 [warn] Our clock is 5 hours, 31 minutes behind the time published in the consensus network status document (2008-09-08 11:00:00 GMT).  Tor needs an accurate clock to work correctly. Please check your time and date settings!

The clock jumps around wildly, e.g.:

Sep 08 13:25:40.205 [warn] Our clock is 5 hours, 36 minutes behind the time published in the consensus network status document (2008-09-08 17:00:00 GMT).  Tor needs an accurate clock to work correctly. Please check your time and date settings!

Sep 08 13:54:04.349 [warn] Our clock is 11 hours, 5 minutes behind the time published in the consensus network status document (2008-09-08 23:00:00 GMT).  Tor needs an accurate clock to work correctly. Please check your time and date settings!

It looks like if you go back in time at just the right moment, you screw
up the bandwidth counting mechanism.

--Roger