Traffic in port 9050 in a relay (denial of service attack?)

Question

I've set up a Tor exit relay (0.2.4.17-rc, debian testing) in my VPS, and it's running well (about 20Gbs/day).

But a lot of traffic (about 50%) is using port 9050 for incoming connections. It's something more than random scans.

Because I am worried, I've run tcpdump and the packets length is about 50-60 bytes long. It seems like DOS or flood traffic: external IP tries to connect and my server refuses (RST, ACK), each time.

My Tor relay (OR) port is 9001, and, of course, SocksPort 0 in my torrc.

Do you think something is wrong with my relay? Why that traffic if my only Tor port is 9001? Should I block that traffic using iptables?

Answer 1

As logforme noted the OP also opened a thread on tor-talk. I summarize the answer here:

The SocksPort is closed using the settings noted in the question. Furthermore the OP set a DROP rule in his packet filter.

However there was a special botnet active. The Rotpoi$on net targets Tor relays. Kent Backman maintains a FAQ on Rotpoi$on and writes:

When it was at its largest in the first quarter of 2013, Rotpoi$on was throwing thousands of packets a second.

In his case the attackers targeted port 8118 and the attacks came from more than 3500 different servers. Other ports were later also identified.

So there is nothing wrong with the relay itself. There is just some kind of background traffic.