1

I am using CentOS and Tor v0.2.7.6 (compiled from source). Nginx is used as a HTTPS proxy and listens to 127.0.0.1:443. I have configured one hidden service. It redirects incoming data to nginx. Service must be reliable, but it becomes unavailable when it receives > 500 requests per minute. Tor is using 99.9% CPU, and tor log contains this:

Feb 25 14:01:45.000 [warn] Your Guard PartitoPirata ($6EF7A07C6C69F24ED3F501698CF4EB3DA2536BFF) is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 94/215. Use counts are 11/13. 96 circuits completed, 2 were unusable, 0 collapsed, and 802 timed out. For reference, your timeout cutoff is 60 seconds.
Feb 25 15:03:42.000 [warn] Your Guard fltrpb ($4B1A65328E06B3BD8C3841497212563827442534) is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 94/288. Use counts are 5/9. 98 circuits completed, 4 were unusable, 0 collapsed, and 5685 timed out. For reference, your timeout cutoff is 60 seconds.

Is my service under DDoS and how to check and prevent it? How can I configure Tor to work with heavy loads?

Improve this question

1 Answer 1

Reset to default
0

You should consider moving Tor to a dedicated machine with a BIG amount of CPU cores. Don;t forget to adjust torrc via NumCPUs X to the real core quantity minus one to make sure that your tor-host machine will have some power for itself. If you're using a cloud host for that - increase number of CPU cores for your server correcting your NumCPUs directive. General sysctl and ulimit-based tuning is in order, of course : fast networking via buffers + number of connections. Feel free to ask further questions!

Improve this answer
2
  • What about hardware acceleration?
    – user3524
    Jun 25, 2016 at 15:18
  • @Pielco11 theoretically you can load an OpenSSL engine when you're starting Tor, but it will not remove the main problem in Tor, that is - IMHO - is created artifically : it has a single-thread crypto. Yes. So you can actually achieve the good offload to make one sigle core dedicated to the crypto, and - you can try to load a HW-enabled engine, but it will not give the improvement expected due to the "queue" single-thread nature.
    – Alexey Vesnin ♦
    Jun 25, 2016 at 17:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .