0

enter image description here

I'm running a pretty strong Tor Middle Relay, not a Guard yet - at least the CPU is good for a Tor Relay - and somehow my server experiences extreme usage right now, and in the picture we can see that something is clearly off. Somehow, Tors download is at 5.9MB/s but upload only 4MB/s.

And what you can't see is Tors extreme resource usage of 1GB RAM (usually it's a half GB only) and - the processor at full 3GHz - 30% CPU usage of 4 cores, while usually I only get 10% CPU usage at 800MHz.

And when looking at htop, it's pretty clear Tor is being DoSed to dead right now, because Tor uses 100% of one full core... Well, it fluctuates between 70% and 110%.

By the time of writing, the DoS attack is still going on..

So, what could I do? Right now, still writing, the DoS has stopped.

enter image description here

So, lucky that it stopped, I wonder why and how this could happen.

I personally think, there could be one possible reason:

  1. Tors DoS protection is bad and someone requested something over and over, resulting in high download and lots of processing.

So I wonder, if that was a new Tor vulnerability or something. I'm stuck here and don't know what to do, because I am very sure that this was a DoS attack and I'd like to inform the developers in case it really was one.

The softwares version is, according to nyx, Tor 0.4.7.12 (recommended).

Note: RAM usage still 1GB. I guess, the RAM usage usually is 1GB, though I had seen it mostly using around 512MB lately.

Improve this question

1 Answer 1

Reset to default
0

Without detailed logs, it's impossible to tell if a DoS attack is occurring or if its another issue. You may want to anonymize your logs and send them as a bug report or inquiry at the tor developers.

Does this happen during daytime in western countries? Have you configured your system correctly? Have you limited the MB/s on your relay? So many variables.

A DoS is just a potential cause in a sea of causes and fate.

Improve this answer
3
  • I'd be helpful to tell me what I would have to do to get the logs I'd need. Limiting speed would not do anything in that case - it happened during daytime (11 o'clock). When I posted. And system configuration is irrelevant to me as it worked before just fine and after that possible DoS happened it continued working fine.
    – france1
    Jan 11 at 11:06
  • @france1 It depends what your OS is. For Linux, check /var/log/syslog or journalctl -e -u tor@default For Windows, use this guide. You may also want to use a network sniffer like Wireshark for any network-side issues. Once you can rule those out, than a DoS is possible.
    – user37855
    Jan 11 at 22:41
  • @france1 FYI, DoS attacks happen frequently on Tor. If a novel attack is being used that exploits a security vulnerability, then report it. If its just a classic "send so much until you cant anymore" then ignore or limit bandwidth in your torrc
    – user37855
    Jan 11 at 22:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .