I'm planning on creating a tor hidden service(in the context of a research project) and am wondering how resilient is it against common (D)DoS attacks(i.e. DNS amplification, UDP flood, etc.) given that the real network address of the server is not known to the attacker? Is it possible to limit the number of open connections to the service via tor in order to avoid resource(open sockets/bandwidth) exhaustion?

  • 1
    Limiting the number of allowed connections makes it easier to consume all your connections, and thereby denying your service to others.
    – Jobiwan
    Jul 6, 2015 at 11:08
  • Then is it possible to set a timeout on each connection so that you can't hold one open indefinitely?
    – Sebi
    Jul 6, 2015 at 11:09
  • That is up to the server behind your HS.
    – Jobiwan
    Jul 6, 2015 at 11:11
  • 3
    There is also this: OnionBalance 0.1.1 Alpha- Hidden Service Load Balancing , lists.torproject.org/pipermail/tor-talk/2015-July/038312.html that can be set up and help with the issue, all though it's currently in alpha.
    – IAmNoone
    Jul 6, 2015 at 13:05
  • @ Stig Atle Steffensen Thanks for the link. Do you know of any other current tor related projects that are in the works?
    – Sebi
    Jul 6, 2015 at 14:41

1 Answer 1


The examples you mention do not apply: Tor only works with TCP streams, not UDP.

It is probably easier to overload the Tor that hosts the Hidden Service than the actual web server behind it, by just creating lots of connections. Setting up a circuit is much more work than serving up a simple web page.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .