2

I am using CentOS and Tor v0.2.7.6 (compiled from source). Nginx is used as a HTTPS proxy and listens to 127.0.0.1:443. I have configured one hidden service. It redirects incoming data to nginx. Service must be reliable, but it becomes unavailable when it receives > 500 requests per minute. Tor is using 99.9% CPU, and tor log contains this:

Feb 25 14:01:45.000 [warn] Your Guard PartitoPirata ($6EF7A07C6C69F24ED3F501698CF4EB3DA2536BFF) is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 94/215. Use counts are 11/13. 96 circuits completed, 2 were unusable, 0 collapsed, and 802 timed out. For reference, your timeout cutoff is 60 seconds.
Feb 25 15:03:42.000 [warn] Your Guard fltrpb ($4B1A65328E06B3BD8C3841497212563827442534) is failing a very large amount of circuits. Most likely this means the Tor network is overloaded, but it could also mean an attack against you or potentially the guard itself. Success counts are 94/288. Use counts are 5/9. 98 circuits completed, 4 were unusable, 0 collapsed, and 5685 timed out. For reference, your timeout cutoff is 60 seconds.

Is my service under DDoS and how to check and prevent it? How can I configure Tor to work with heavy loads?

1

You should consider moving Tor to a dedicated machine with a BIG amount of CPU cores. Don;t forget to adjust torrc via NumCPUs X to the real core quantity minus one to make sure that your tor-host machine will have some power for itself. If you're using a cloud host for that - increase number of CPU cores for your server correcting your NumCPUs directive. General sysctl and ulimit-based tuning is in order, of course : fast networking via buffers + number of connections. Feel free to ask further questions!

  • What about hardware acceleration? – user3524 Jun 25 '16 at 15:18
  • @Pielco11 theoretically you can load an OpenSSL engine when you're starting Tor, but it will not remove the main problem in Tor, that is - IMHO - is created artifically : it has a single-thread crypto. Yes. So you can actually achieve the good offload to make one sigle core dedicated to the crypto, and - you can try to load a HW-enabled engine, but it will not give the improvement expected due to the "queue" single-thread nature. – Alexey Vesnin Jun 25 '16 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.