While we are building a denial of service protection using and onionbalance for our HSv3 resources was discovered an interesting thing: during testing with simulated DDoS (launched 1000 tor client nodes per server on 4 dedicated servers and pushing traffic throught it to our HSv3), there was a situation where one server can push around 350mbit/s and we see it on onionbalance backend, BUT, 4 servers do total the same 350mbit/s like a single server, why?

We saw large attacks (10+gbit/s) on our resource from unknown source, but we cant reproduce it for testing purpose because of this strange issue. Looks like tor network using sort of ratelimiting?

We tried to use servers in different locations but result is the same - 1 server pushing 350mbit/s, BUT four or more servers pushes 350mbit/s total too.

Whats wrong?

  • What does the throughput of each individual server look like? Are they each pushing 350 Mbps / 4 = 87 Mbps? Entry relays will rate limit circuits from connected IPs, but if you're using many tor clients, you should be using many different guard/entry relays so I don't think that would be an issue.
    – Steve
    Feb 23 at 15:03
  • Each server pushes around 300mbit/s but on backend we see only ~400mbit/s max, HSv3 service is fully working and not overloaded. When we tested same servers on our clearnet site they pushed about 500mbit/s per server and on backend we got expected ~2gbit/s. Strange...
    – Culture
    Feb 24 at 12:52
  • @Culture Comments are supposed to be temporary; I suggest you edit that information into the question. Feb 27 at 10:01
  • I asked at Twitter and the question was, if you have or can draw a network diagram. This could help to find issues.
    – Jens Kubieziel
    May 23 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.