Possible compression bomb; abandoning stream

MrRant · July 25, 2023, 10:29am

Jul 25 01:18:01 Tor[1010]: Possible compression bomb; abandoning stream.
Jul 25 01:18:01 Tor[1010]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul 25 01:19:01 Tor[1010]: Possible compression bomb; abandoning stream.
Jul 25 01:19:01 Tor[1010]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul 25 01:20:01 Tor[1010]: Possible compression bomb; abandoning stream.
Jul 25 01:20:01 Tor[1010]: Unable to decompress HTTP body (tried Zstandard compressed, on Directory connection (client reading) with 217.76.139.49:443). [176 similar message(s) sup>
Jul 25 01:20:01 Tor[1010]: Possible compression bomb; abandoning stream.
Jul 25 01:20:01 Tor[1010]: Possible compression bomb; abandoning stream.
Jul 25 01:21:01 Tor[1010]: Possible compression bomb; abandoning stream.
Jul 25 01:22:01 Tor[1010]: message repeated 5 times: [ Possible compression bomb; abandoning stream.]

Hi there, I’ve noticed this in my logs since setting up a bridge yesterday. My searching around didn’t lead me to if it’s something I should ignore or something is misconfigured.

Vort · July 26, 2023, 10:02am

I see such messages too and I think they appear because of a bug in Tor.
But because my node continues to function as intended, I think this problem is not severe and can be ignored.

0xbytes · July 27, 2023, 3:54pm

I do not believe it is a bug in tor. Compression bombing is a type of DoS attack. It appears tor is attempting to recognize this and abandon the HTTP stream before decompressing something it cant handle.

Vort · July 27, 2023, 6:07pm

Tor shows this message even when receiving data from trusted authority nodes.
I doubt they perform DoS attack.

0xbytes · July 27, 2023, 6:18pm

Hmm… that doesnt make much sense. I see where youre coming from. But compression bombs are a definite attack type and abandoning the stream is a good way to prevent that.

It could be a bug but I think I would trust what it is saying more than not. I mean, 176 messages saying Unable to decompress HTTP body both prefixed and followed by more compression bomb alerts all within the same 4 minutes… doesnt seem like a bug to me. It sounds like either his node totally shit or he experienced a compression bomb attack.

@MrRant - Is your log file filled with these almost every line/second or are they intermittent?

0xbytes · July 27, 2023, 6:27pm

To add on this, I see these alerts in my log files as well and I feel they are legitimate findings.

Vort · July 27, 2023, 8:20pm

There may be present both bug (which make normal answers detected as bombs) and actual bombs.

MrRant · July 28, 2023, 6:05am

sorry for the late reply @vort and @0xbytes

Below are the instances since I stood up the server a few days ago. I’ve only filtered to the compression bomb messaging but can post the full logs too.

Jul 25 0:20:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 0:21:00 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 0:26:01 Server Tor[1010]: message repeated 16 times: [ Possible compression bomb; abandoning stream.]

Jul 25 0:27:00 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 0:54:01 Server Tor[1010]: message repeated 83 times: [ Possible compression bomb; abandoning stream.]

Jul 25 0:55:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:04:01 Server Tor[1010]: message repeated 29 times: [ Possible compression bomb; abandoning stream.]

Jul 25 1:05:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:09:01 Server Tor[1010]: message repeated 14 times: [ Possible compression bomb; abandoning stream.]

Jul 25 1:10:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:10:01 Server Tor[1010]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 1:11:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:17:01 Server Tor[1010]: message repeated 20 times: [ Possible compression bomb; abandoning stream.]

Jul 25 1:18:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:18:01 Server Tor[1010]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 1:19:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:19:01 Server Tor[1010]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 1:20:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:20:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:20:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:21:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:22:01 Server Tor[1010]: message repeated 5 times: [ Possible compression bomb; abandoning stream.]

Jul 25 1:23:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 1:24:01 Server Tor[1010]: message repeated 5 times: [ Possible compression bomb; abandoning stream.]

Jul 25 1:25:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 2:10:01 Server Tor[1010]: message repeated 137 times: [ Possible compression bomb; abandoning stream.]

Jul 25 2:11:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 2:17:01 Server Tor[1010]: message repeated 19 times: [ Possible compression bomb; abandoning stream.]

Jul 25 2:17:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 2:20:01 Server Tor[1010]: message repeated 7 times: [ Possible compression bomb; abandoning stream.]

Jul 25 2:20:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 2:48:01 Server Tor[1010]: message repeated 85 times: [ Possible compression bomb; abandoning stream.]

Jul 25 2:49:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 2:52:01 Server Tor[1010]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]

Jul 25 2:53:01 Server Tor[1010]: Possible compression bomb; abandoning stream.

Jul 25 3:04:01 Server Tor[1010]: message repeated 35 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:05:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:05:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:05:10 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:06:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:09:09 Server Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:10:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:10:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:11:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:11:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:12:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:15:10 Server Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:16:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:16:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:17:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:34:09 Server Tor[4685]: message repeated 53 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:35:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:35:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:36:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:43:09 Server Tor[4685]: message repeated 23 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:44:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:57:09 Server Tor[4685]: message repeated 40 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:58:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:58:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 3:59:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 3:59:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:00:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:00:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:01:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:01:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:02:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:02:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:03:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:03:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:04:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:04:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:05:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:06:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:06:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:07:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:07:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:08:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:08:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:09:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:09:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:10:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:10:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:11:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:11:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:12:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:12:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:13:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:13:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:14:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:14:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:15:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:15:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:16:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:16:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:17:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:17:10 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:18:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:18:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:19:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:19:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:20:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:20:09 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 25 4:21:09 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 25 4:40:09 Server Tor[4685]: message repeated 57 times: [ Possible compression bomb; abandoning stream.]

Jul 26 2:16:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 2:16:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 2:16:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 2:17:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 2:20:14 Server Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]

Jul 26 2:21:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 2:39:14 Server Tor[4685]: message repeated 56 times: [ Possible compression bomb; abandoning stream.]

Jul 26 2:40:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 3:04:14 Server Tor[4685]: message repeated 74 times: [ Possible compression bomb; abandoning stream.]

Jul 26 3:05:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 3:05:14 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 26 3:06:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 3:09:14 Server Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]

Jul 26 3:10:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 3:10:14 Server Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]

Jul 26 3:11:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 3:16:14 Server Tor[4685]: message repeated 15 times: [ Possible compression bomb; abandoning stream.]

Jul 26 3:16:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 3:16:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 3:17:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 3:45:14 Server Tor[4685]: message repeated 84 times: [ Possible compression bomb; abandoning stream.]

Jul 26 3:46:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 3:59:14 Server Tor[4685]: message repeated 39 times: [ Possible compression bomb; abandoning stream.]

Jul 26 4:00:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 4:05:14 Server Tor[4685]: message repeated 17 times: [ Possible compression bomb; abandoning stream.]

Jul 26 4:06:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 4:16:14 Server Tor[4685]: message repeated 30 times: [ Possible compression bomb; abandoning stream.]

Jul 26 4:16:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 4:16:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 4:17:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:05:15 Server Tor[4685]: message repeated 146 times: [ Possible compression bomb; abandoning stream.]

Jul 26 5:06:14 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:08:15 Server Tor[4685]: message repeated 8 times: [ Possible compression bomb; abandoning stream.]

Jul 26 5:09:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:14:15 Server Tor[4685]: message repeated 17 times: [ Possible compression bomb; abandoning stream.]

Jul 26 5:15:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:16:15 Server Tor[4685]: message repeated 3 times: [ Possible compression bomb; abandoning stream.]

Jul 26 5:16:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:16:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:17:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:29:15 Server Tor[4685]: message repeated 38 times: [ Possible compression bomb; abandoning stream.]

Jul 26 5:30:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:39:15 Server Tor[4685]: message repeated 29 times: [ Possible compression bomb; abandoning stream.]

Jul 26 5:40:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:44:15 Server Tor[4685]: message repeated 14 times: [ Possible compression bomb; abandoning stream.]

Jul 26 5:45:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:50:15 Server Tor[4685]: message repeated 17 times: [ Possible compression bomb; abandoning stream.]

Jul 26 5:51:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 5:56:15 Server Tor[4685]: message repeated 17 times: [ Possible compression bomb; abandoning stream.]

Jul 26 5:57:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 6:01:15 Server Tor[4685]: message repeated 14 times: [ Possible compression bomb; abandoning stream.]

Jul 26 6:02:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 6:05:15 Server Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]

Jul 26 6:06:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 6:16:15 Server Tor[4685]: message repeated 30 times: [ Possible compression bomb; abandoning stream.]

Jul 26 6:16:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 6:16:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 6:17:15 Server Tor[4685]: Possible compression bomb; abandoning stream.

Jul 26 6:21:15 Server Tor[4685]: message repeated 12 times: [ Possible compression bomb; abandoning stream.]

MrRant · July 28, 2023, 6:05am

Actually looks like I can’t upload my syslog as new user.

Vort · July 28, 2023, 6:46am

I have less of them:

Nov 02 06:08:50.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:08:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:09:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:09:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:09:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:10:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:10:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:10:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:11:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:12:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:12:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:12:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:13:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:13:59.000 [warn] Possible compression bomb; abandoning stream.
Oct 06 03:25:05.000 [warn] Possible compression bomb; abandoning stream.
Jan 13 14:26:00.000 [warn] Possible compression bomb; abandoning stream.
May 15 07:07:54.000 [warn] Possible compression bomb; abandoning stream.
Jun 03 05:16:01.000 [warn] Possible compression bomb; abandoning stream.
Jun 28 21:26:07.000 [warn] Possible compression bomb; abandoning stream.
Jun 28 21:26:07.000 [warn] Possible compression bomb; abandoning stream.
Jul 02 01:28:09.000 [warn] Possible compression bomb; abandoning stream.
Jul 07 14:06:58.000 [warn] Possible compression bomb; abandoning stream.
Jul 09 14:04:36.000 [warn] Possible compression bomb; abandoning stream.
Jul 09 14:04:36.000 [warn] Possible compression bomb; abandoning stream.
Jul 09 14:04:36.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 05:25:44.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 05:25:45.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 06:16:45.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 07:23:46.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 07:24:45.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 07:25:46.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:27.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:27.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:28.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:28.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:28.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:18:26.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:06:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:06:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:06:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:07:02.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:07:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:07:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 03:30:23.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 03:30:23.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 04:26:23.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 04:26:24.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 04:27:23.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 06:23:25.000 [warn] Possible compression bomb; abandoning stream.

Probably because I operate Guard node, not bridge.

0xbytes · July 28, 2023, 11:53am

I agree with @Vort
Like you had said, could be either a bug or legitimate bombs. Probably best to check tor metrics for the IP associated with the ‘Unable to decompress HTTP body’ messages if you’re really curious.

MrRant · July 28, 2023, 5:25pm

Could someone point me in that direction?

MrRant · July 29, 2023, 8:16am

I don’t see this occurring in the last 24-36 or so hours as I look at the logs.

Vort · August 23, 2023, 4:33pm

Version 0.4.8.4 have fix related to this problem (fd3f9e85).

Jul	25	0:20:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	0:21:00	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	0:26:01	Server	Tor[1010]: message repeated 16 times: [ Possible compression bomb; abandoning stream.]
Jul	25	0:27:00	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	0:54:01	Server	Tor[1010]: message repeated 83 times: [ Possible compression bomb; abandoning stream.]
Jul	25	0:55:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:04:01	Server	Tor[1010]: message repeated 29 times: [ Possible compression bomb; abandoning stream.]
Jul	25	1:05:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:09:01	Server	Tor[1010]: message repeated 14 times: [ Possible compression bomb; abandoning stream.]
Jul	25	1:10:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:10:01	Server	Tor[1010]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	1:11:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:17:01	Server	Tor[1010]: message repeated 20 times: [ Possible compression bomb; abandoning stream.]
Jul	25	1:18:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:18:01	Server	Tor[1010]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	1:19:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:19:01	Server	Tor[1010]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	1:20:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:20:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:20:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:21:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:22:01	Server	Tor[1010]: message repeated 5 times: [ Possible compression bomb; abandoning stream.]
Jul	25	1:23:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	1:24:01	Server	Tor[1010]: message repeated 5 times: [ Possible compression bomb; abandoning stream.]
Jul	25	1:25:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	2:10:01	Server	Tor[1010]: message repeated 137 times: [ Possible compression bomb; abandoning stream.]
Jul	25	2:11:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	2:17:01	Server	Tor[1010]: message repeated 19 times: [ Possible compression bomb; abandoning stream.]
Jul	25	2:17:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	2:20:01	Server	Tor[1010]: message repeated 7 times: [ Possible compression bomb; abandoning stream.]
Jul	25	2:20:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	2:48:01	Server	Tor[1010]: message repeated 85 times: [ Possible compression bomb; abandoning stream.]
Jul	25	2:49:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	2:52:01	Server	Tor[1010]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]
Jul	25	2:53:01	Server	Tor[1010]: Possible compression bomb; abandoning stream.
Jul	25	3:04:01	Server	Tor[1010]: message repeated 35 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:05:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:05:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:05:10	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:06:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:09:09	Server	Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:10:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:10:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:11:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:11:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:12:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:15:10	Server	Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:16:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:16:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:17:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:34:09	Server	Tor[4685]: message repeated 53 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:35:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:35:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:36:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:43:09	Server	Tor[4685]: message repeated 23 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:44:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:57:09	Server	Tor[4685]: message repeated 40 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:58:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:58:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	3:59:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	3:59:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:00:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:00:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:01:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:01:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:02:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:02:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:03:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:03:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:04:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:04:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:05:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:06:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:06:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:07:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:07:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:08:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:08:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:09:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:09:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:10:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:10:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:11:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:11:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:12:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:12:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:13:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:13:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:14:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:14:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:15:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:15:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:16:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:16:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:17:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:17:10	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:18:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:18:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:19:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:19:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:20:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:20:09	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	25	4:21:09	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	25	4:40:09	Server	Tor[4685]: message repeated 57 times: [ Possible compression bomb; abandoning stream.]
Jul	26	2:16:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	2:16:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	2:16:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	2:17:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	2:20:14	Server	Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]
Jul	26	2:21:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	2:39:14	Server	Tor[4685]: message repeated 56 times: [ Possible compression bomb; abandoning stream.]
Jul	26	2:40:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	3:04:14	Server	Tor[4685]: message repeated 74 times: [ Possible compression bomb; abandoning stream.]
Jul	26	3:05:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	3:05:14	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	26	3:06:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	3:09:14	Server	Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]
Jul	26	3:10:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	3:10:14	Server	Tor[4685]: message repeated 2 times: [ Possible compression bomb; abandoning stream.]
Jul	26	3:11:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	3:16:14	Server	Tor[4685]: message repeated 15 times: [ Possible compression bomb; abandoning stream.]
Jul	26	3:16:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	3:16:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	3:17:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	3:45:14	Server	Tor[4685]: message repeated 84 times: [ Possible compression bomb; abandoning stream.]
Jul	26	3:46:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	3:59:14	Server	Tor[4685]: message repeated 39 times: [ Possible compression bomb; abandoning stream.]
Jul	26	4:00:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	4:05:14	Server	Tor[4685]: message repeated 17 times: [ Possible compression bomb; abandoning stream.]
Jul	26	4:06:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	4:16:14	Server	Tor[4685]: message repeated 30 times: [ Possible compression bomb; abandoning stream.]
Jul	26	4:16:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	4:16:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	4:17:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:05:15	Server	Tor[4685]: message repeated 146 times: [ Possible compression bomb; abandoning stream.]
Jul	26	5:06:14	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:08:15	Server	Tor[4685]: message repeated 8 times: [ Possible compression bomb; abandoning stream.]
Jul	26	5:09:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:14:15	Server	Tor[4685]: message repeated 17 times: [ Possible compression bomb; abandoning stream.]
Jul	26	5:15:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:16:15	Server	Tor[4685]: message repeated 3 times: [ Possible compression bomb; abandoning stream.]
Jul	26	5:16:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:16:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:17:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:29:15	Server	Tor[4685]: message repeated 38 times: [ Possible compression bomb; abandoning stream.]
Jul	26	5:30:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:39:15	Server	Tor[4685]: message repeated 29 times: [ Possible compression bomb; abandoning stream.]
Jul	26	5:40:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:44:15	Server	Tor[4685]: message repeated 14 times: [ Possible compression bomb; abandoning stream.]
Jul	26	5:45:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:50:15	Server	Tor[4685]: message repeated 17 times: [ Possible compression bomb; abandoning stream.]
Jul	26	5:51:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	5:56:15	Server	Tor[4685]: message repeated 17 times: [ Possible compression bomb; abandoning stream.]
Jul	26	5:57:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	6:01:15	Server	Tor[4685]: message repeated 14 times: [ Possible compression bomb; abandoning stream.]
Jul	26	6:02:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	6:05:15	Server	Tor[4685]: message repeated 11 times: [ Possible compression bomb; abandoning stream.]
Jul	26	6:06:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	6:16:15	Server	Tor[4685]: message repeated 30 times: [ Possible compression bomb; abandoning stream.]
Jul	26	6:16:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	6:16:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	6:17:15	Server	Tor[4685]: Possible compression bomb; abandoning stream.
Jul	26	6:21:15	Server	Tor[4685]: message repeated 12 times: [ Possible compression bomb; abandoning stream.]