Traffic monitoring of specific hidden services

Question

I offer onion hosting to the general public and I am having some issues with many hidden services when they share an instance of Tor with a very busy service. When there is a very busy hidden service the other users suffer from outages themselves. I run many instances of Tor and most of which have a bunch of users in them. Some users get moved to their own instances when they are busy.

My question is about monitoring the traffic of a particular hidden service on Tor's side of things, so I can identify busy hidden services. At the moment I merely monitor the resulting application traffic such as nginx logs. This is far from ideal because some hidden services when attacked don't go as far as making proper HTTP requests.

I am interested in monitoring the Tor process for an instance itself, and seeing the busiest hidden services. I would like to do this without using things like debug logging, but if that is my only chance let me know. I think that the control port interface could be used somehow to do this. I am proficient in Python programming and it coding is required it would be in that language.

Also, if you know some ways I can optimize Tor within its torrc configuration for doing lots of hidden services I would like to know.

Answer 1

The answer is a way more simple than the approach you're talking about. This is what I suggest you to do:

• Make a pool of Tor nodes - middle ones, no need for exits e.t.c...
• Every hidden service should use it's own VM or a container, containing it's own tiny Tor instance *This internal tor instance uses a pool of your nodes to be it's hops for exiting to the Tor network - and just them alone!

After that Tor's internal mechanisms should take the job you need to do: i.e. if one of the nodes is very busy, then another faster one will be selected automatically. One more advice - if your hidden services are able to run in parallel - try utilizing an onion service descriptor offloading like it's done on a busy sites