11

I have a new exit relay running on DSL. It's version 0.2.3.25 running on Windows. Most of the time, there's only a few connections, but every so often there's a lot more. They all appear and disappear in a short time. This is copied from the log.

Oct 10 21:32:18.000 [notice] Heartbeat: Tor's uptime is 2 days 6:00 hours, with 8 circuits open. I've sent 1.23 GB and received 1.42 GB.

Oct 11 03:32:18.000 [notice] Heartbeat: Tor's uptime is 2 days 12:00 hours, with 10 circuits open. I've sent 1.40 GB and received 1.58 GB.

Oct 11 09:32:18.000 [notice] Heartbeat: Tor's uptime is 2 days 18:00 hours, with 9 circuits open. I've sent 1.55 GB and received 1.72 GB.

Oct 11 15:32:18.000 [notice] Heartbeat: Tor's uptime is 3 days 0:00 hours, with 728 circuits open. I've sent 1.70 GB and received 1.88 GB.

Oct 11 21:32:18.000 [notice] Heartbeat: Tor's uptime is 3 days 6:00 hours, with 849 circuits open. I've sent 1.78 GB and received 1.96 GB.

Oct 12 03:32:18.000 [notice] Heartbeat: Tor's uptime is 3 days 12:00 hours, with 11 circuits open. I've sent 1.88 GB and received 2.07 GB.

Oct 12 09:32:18.000 [notice] Heartbeat: Tor's uptime is 3 days 18:00 hours, with 29 circuits open. I've sent 2.06 GB and received 2.26 GB.

Is this normal for a relay?

edit, adding more recent log entries.

It did seem to disappear for a while, until last weekend. From the log:

Apr 12 13:23:46.000 [notice] Heartbeat: Tor's uptime is 18:00 hours, with 16 circuits open. I've sent 440.84 MB and received 431.09 MB.

Apr 12 19:23:46.000 [notice] Heartbeat: Tor's uptime is 1 day 0:00 hours, with 8 circuits open. I've sent 495.17 MB and received 488.92 MB.

Apr 13 01:23:46.000 [notice] Heartbeat: Tor's uptime is 1 day 6:00 hours, with 2312 circuits open. I've sent 546.78 MB and received 545.24 MB.

Apr 13 07:23:46.000 [notice] Heartbeat: Tor's uptime is 1 day 12:00 hours, with 3221 circuits open. I've sent 605.06 MB and received 617.01 MB.

Those quantities are far above the MaxConnections value I set in the registry, which makes me ask how it's even possible. I shut Tor down and rebooted my system. Within 15 minutes of rebooting, I had over 1000 connections again. Each time, the connections were inbound. There was almost no outbound connections and nearly zero traffic. By Monday, everything was back to normal, a much lower number of inbound connections and a corresponding amount of outbound connections with traffic.

Improve this question
1
  • Let me rephrase the question. Why do I get these short lived spikes in open circuit quantities? The quantity doesn't build up over time. They all appear and disappear in a short time period. When this happens, there is no traffic on most of them. The connection monitor on the software firewall shows that most of them carried the same amount of traffic. Is this botnet traffic?
    – Herbalist
    Oct 13, 2013 at 12:27

1 Answer 1

Reset to default
6

During the time when you encountered this fluctuation Tor had some problems with a botnet. Some ukrainian guy deployed Tor nodes and they build cuircits. As there were quite a huge amount of clients, this put a fair share of load on the relays. Maybe your relay also was affected.

users between August 2013 and January 2014

This fluctuation should have disappeared because tried to remove the malware.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .