2

I run a relay.
It has a SocksPort listening, but I don’t use it as a client for anything at the moment. It also hosts a hidden service.

From time to time I get warnings like this:

[warn] Your Guard nickname ($F1N63RPR1N7) is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 127/255. Use counts are 96/96. 201 circuits completed, 0 were unusable, 74 collapsed, and 6 timed out. For reference, your timeout cutoff is 60 seconds.

It seems I make a lot of circuits..

Connections (157 inbound, 149 outbound, 1 hidden, 61 circuit, 1 directory, 1 control):
(..)
| aaa.aaa.aaa.aaa        -->  xx.xx.xx.xx (cc)       21.0m (CIRCUIT)
| |  134.102.200.101 (de)     csUniHB                   1 / Guard
| |  192.42.116.161 (nl)      Unnamed                   2 / Middle
| +- xx.xx.xx.xx (cc)         (redacted)                3 / Exit
| aaa.aaa.aaa.aaa        -->  yy.yy.yy.yy (cc)       21.0m (CIRCUIT)
| |  134.102.200.101 (de)     csUniHB                   1 / Guard
| |  212.47.229.2 (fr)        scaletor                  2 / Middle
| +- yy.yy.yy.yy (cc)         (redacted)                3 / Exit
| aaa.aaa.aaa.aaa        -->  zz.zz.zz.zz (cc)       21.0m (CIRCUIT)
| |  46.252.24.56 (de)        thewatch                  1 / Guard
| |  91.121.23.100 (fr)       0x3d002                   2 / Middle
| +- zz.zz.zz.zz (cc)         (redacted)                3 / Exit
(..etc..)

aaa.aaa.aaa.aaa is the external IP address on my router.
I have no port forwarded to my socks port.

  • What would cause so many circuits?
  • Is it probably me that causes the large amount of circuit failures in the guard as per the warning message?
  • What can I find out / do about it?
  • 1
    Run a relay on the same machine that runs a HS is unsafe because it exposes its HS, try out to run one or another.. is something changing? – user3524 Dec 20 '15 at 11:01
  • @Pielco11: My HS doesn't need to be very hidden. Also, it would take a while to tell, because I get this warning only about twice a week or so. I could run a 2nd instance of Tor for the HS, and then a 2nd instance of arm .. strikes me as inconvenient. But yes, I am aware that it is bad practice. Thanks. – Jobiwan Dec 20 '15 at 20:57
  • To help you I need to see a torrc config, please post it – Alexey Vesnin Dec 27 '15 at 3:40
1

Someone was probably pounding on your HS.

As part of establishing a circuit the server side of a HS establishes a circuit to the Rendezvous Point. So if there's lots of clients all trying to access a HS at once, it results in lots of circuit creation.

  • I checked about a dozen, and none of the 'exits' of those circuits are actual exit nodes. So this would indicate that they are in fact HS rendezvous circuits. I increased the NumEntryGuards, hoping to spread the load. Haven't seen the warning since Christmas. Still seeing 50~100 circuits. I get about 3000~4000 hits per day on my HS. That's not really pounding. – Jobiwan Jan 22 '16 at 22:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.