3

I run a relay.
It has a SocksPort listening, but I don’t use it as a client for anything at the moment. It also hosts a hidden service.

From time to time I get warnings like this:

[warn] Your Guard nickname ($F1N63RPR1N7) is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 127/255. Use counts are 96/96. 201 circuits completed, 0 were unusable, 74 collapsed, and 6 timed out. For reference, your timeout cutoff is 60 seconds.

It seems I make a lot of circuits.. 

Connections (157 inbound, 149 outbound, 1 hidden, 61 circuit, 1 directory, 1 control):
(..)
| aaa.aaa.aaa.aaa        -->  xx.xx.xx.xx (cc)       21.0m (CIRCUIT)
| |  134.102.200.101 (de)     csUniHB                   1 / Guard
| |  192.42.116.161 (nl)      Unnamed                   2 / Middle
| +- xx.xx.xx.xx (cc)         (redacted)                3 / Exit
| aaa.aaa.aaa.aaa        -->  yy.yy.yy.yy (cc)       21.0m (CIRCUIT)
| |  134.102.200.101 (de)     csUniHB                   1 / Guard
| |  212.47.229.2 (fr)        scaletor                  2 / Middle
| +- yy.yy.yy.yy (cc)         (redacted)                3 / Exit
| aaa.aaa.aaa.aaa        -->  zz.zz.zz.zz (cc)       21.0m (CIRCUIT)
| |  46.252.24.56 (de)        thewatch                  1 / Guard
| |  91.121.23.100 (fr)       0x3d002                   2 / Middle
| +- zz.zz.zz.zz (cc)         (redacted)                3 / Exit
(..etc..)

aaa.aaa.aaa.aaa is the external IP address on my router.
I have no port forwarded to my socks port.

  • What would cause so many circuits?
  • Is it probably me that causes the large amount of circuit failures in the guard as per the warning message?
  • What can I find out / do about it?
Improve this question
3
  • 1
    Run a relay on the same machine that runs a HS is unsafe because it exposes its HS, try out to run one or another.. is something changing?
    – user3524
    Commented Dec 20, 2015 at 11:01
  • @Pielco11: My HS doesn't need to be very hidden. Also, it would take a while to tell, because I get this warning only about twice a week or so. I could run a 2nd instance of Tor for the HS, and then a 2nd instance of arm .. strikes me as inconvenient. But yes, I am aware that it is bad practice. Thanks.
    – Jobiwan
    Commented Dec 20, 2015 at 20:57
  • To help you I need to see a torrc config, please post it
    – Alexey Vesnin ♦
    Commented Dec 27, 2015 at 3:40

1 Answer 1

Reset to default
1

Someone was probably pounding on your HS.

As part of establishing a circuit the server side of a HS establishes a circuit to the Rendezvous Point. So if there's lots of clients all trying to access a HS at once, it results in lots of circuit creation.

Improve this answer
1
  • 1
    I checked about a dozen, and none of the 'exits' of those circuits are actual exit nodes. So this would indicate that they are in fact HS rendezvous circuits. I increased the NumEntryGuards, hoping to spread the load. Haven't seen the warning since Christmas. Still seeing 50~100 circuits. I get about 3000~4000 hits per day on my HS. That's not really pounding.
    – Jobiwan
    Commented Jan 22, 2016 at 22:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .