4

While we are building a denial of service protection using and onionbalance for our HSv3 resources was discovered an interesting thing: during testing with simulated DDoS (launched 1000 tor client nodes per server on 4 dedicated servers and pushing traffic throught it to our HSv3), there was a situation where one server can push around 350mbit/s and we see it on onionbalance backend, BUT, 4 servers do total the same 350mbit/s like a single server, why?

We saw large attacks (10+gbit/s) on our resource from unknown source, but we cant reproduce it for testing purpose because of this strange issue. Looks like tor network using sort of ratelimiting?

We tried to use servers in different locations but result is the same - 1 server pushing 350mbit/s, BUT four or more servers pushes 350mbit/s total too.

Whats wrong?

Improve this question
4
  • What does the throughput of each individual server look like? Are they each pushing 350 Mbps / 4 = 87 Mbps? Entry relays will rate limit circuits from connected IPs, but if you're using many tor clients, you should be using many different guard/entry relays so I don't think that would be an issue.
    – Steve
    Feb 23, 2021 at 15:03
  • Each server pushes around 300mbit/s but on backend we see only ~400mbit/s max, HSv3 service is fully working and not overloaded. When we tested same servers on our clearnet site they pushed about 500mbit/s per server and on backend we got expected ~2gbit/s. Strange...
    – Culture
    Feb 24, 2021 at 12:52
  • @Culture Comments are supposed to be temporary; I suggest you edit that information into the question.
    – Brian Drake
    Feb 27, 2021 at 10:01
  • I asked at Twitter and the question was, if you have or can draw a network diagram. This could help to find issues.
    – Jens Kubieziel ♦
    May 23, 2021 at 11:27

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .