# Possible compression bomb; abandoning stream
**URL:** https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479
**Category:** Relay Operator
**Created:** [July 25, 2023, 10:29am UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479 "2023-07-25T10:29:05Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@MrRant](https://forum.torproject.org/u/MrRant)
#### Post date: [July 25, 2023, 10:29am UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/1 "2023-07-25T10:29:05Z")
> Jul 25 01:18:01 Tor[1010]: Possible compression bomb; abandoning stream.
> Jul 25 01:18:01 Tor[1010]: message repeated 2 times: [Possible compression bomb; abandoning stream.]
> Jul 25 01:19:01 Tor[1010]: Possible compression bomb; abandoning stream.
> Jul 25 01:19:01 Tor[1010]: message repeated 2 times: [Possible compression bomb; abandoning stream.]
> Jul 25 01:20:01 Tor[1010]: Possible compression bomb; abandoning stream.
> Jul 25 01:20:01 Tor[1010]: Unable to decompress HTTP body (tried Zstandard compressed, on Directory connection (client reading) with 217.76.139.49:443). [176 similar message(s) sup\>
> Jul 25 01:20:01 Tor[1010]: Possible compression bomb; abandoning stream.
> Jul 25 01:20:01 Tor[1010]: Possible compression bomb; abandoning stream.
> Jul 25 01:21:01 Tor[1010]: Possible compression bomb; abandoning stream.
> Jul 25 01:22:01 Tor[1010]: message repeated 5 times: [Possible compression bomb; abandoning stream.]
Hi there, I’ve noticed this in my logs since setting up a bridge yesterday. My searching around didn’t lead me to if it’s something I should ignore or something is misconfigured.
---
### Author:  [@Vort](https://forum.torproject.org/u/Vort)
#### Post date: [July 26, 2023, 10:02am UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/2 "2023-07-26T10:02:13Z")
I see such messages too and I think they appear because of a bug in Tor.
But because my node continues to function as intended, I think this problem is not severe and can be ignored.
---
### Author:  [@0xbytes](https://forum.torproject.org/u/0xbytes)
#### Post date: [July 27, 2023, 3:54pm UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/3 "2023-07-27T15:54:04Z")
I do not believe it is a bug in tor. Compression bombing is a type of DoS attack. It appears tor is attempting to recognize this and abandon the HTTP stream before decompressing something it cant handle.
---
### Author:  [@Vort](https://forum.torproject.org/u/Vort)
#### Post date: [July 27, 2023, 6:07pm UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/4 "2023-07-27T18:07:36Z")
Tor shows this message even when receiving data from trusted authority nodes.
I doubt they perform DoS attack.
---
### Author:  [@0xbytes](https://forum.torproject.org/u/0xbytes)
#### Post date: [July 27, 2023, 6:18pm UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/5 "2023-07-27T18:18:18Z")
Hmm… that doesnt make much sense. I see where youre coming from. But compression bombs are a definite attack type and abandoning the stream is a good way to prevent that.
It could be a bug but I think I would trust what it is saying more than not. I mean, 176 messages saying _Unable to decompress HTTP body_ both prefixed and followed by more compression bomb alerts all within the same 4 minutes… doesnt seem like a bug to me. It sounds like either his node totally shit or he experienced a compression bomb attack.
@MrRant - Is your log file filled with these almost every line/second or are they intermittent?
---
### Author:  [@0xbytes](https://forum.torproject.org/u/0xbytes)
#### Post date: [July 27, 2023, 6:27pm UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/6 "2023-07-27T18:27:27Z")
To add on this, I see these alerts in my log files as well and I feel they are legitimate findings.
---
### Author:  [@Vort](https://forum.torproject.org/u/Vort)
#### Post date: [July 27, 2023, 8:20pm UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/7 "2023-07-27T20:20:12Z")
There may be present both bug (which make normal answers detected as bombs) and actual bombs.
---
### Author:  [@MrRant](https://forum.torproject.org/u/MrRant)
#### Post date: [July 28, 2023, 6:05am UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/8 "2023-07-28T06:05:35Z")
sorry for the late reply @vort and @0xbytes
Below are the instances since I stood up the server a few days ago. I’ve only filtered to the compression bomb messaging but can post the full logs too.
> | Jul | 25 | 0:20:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | --- | --- | --- | --- | --- |
> | Jul | 25 | 0:21:00 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 0:26:01 | Server | Tor[1010]: message repeated 16 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 0:27:00 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 0:54:01 | Server | Tor[1010]: message repeated 83 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 0:55:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:04:01 | Server | Tor[1010]: message repeated 29 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 1:05:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:09:01 | Server | Tor[1010]: message repeated 14 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 1:10:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:10:01 | Server | Tor[1010]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 1:11:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:17:01 | Server | Tor[1010]: message repeated 20 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 1:18:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:18:01 | Server | Tor[1010]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 1:19:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:19:01 | Server | Tor[1010]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 1:20:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:20:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:20:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:21:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:22:01 | Server | Tor[1010]: message repeated 5 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 1:23:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 1:24:01 | Server | Tor[1010]: message repeated 5 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 1:25:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 2:10:01 | Server | Tor[1010]: message repeated 137 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 2:11:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 2:17:01 | Server | Tor[1010]: message repeated 19 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 2:17:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 2:20:01 | Server | Tor[1010]: message repeated 7 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 2:20:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 2:48:01 | Server | Tor[1010]: message repeated 85 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 2:49:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 2:52:01 | Server | Tor[1010]: message repeated 11 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 2:53:01 | Server | Tor[1010]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:04:01 | Server | Tor[1010]: message repeated 35 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:05:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:05:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:05:10 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:06:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:09:09 | Server | Tor[4685]: message repeated 11 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:10:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:10:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:11:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:11:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:12:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:15:10 | Server | Tor[4685]: message repeated 11 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:16:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:16:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:17:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:34:09 | Server | Tor[4685]: message repeated 53 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:35:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:35:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:36:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:43:09 | Server | Tor[4685]: message repeated 23 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:44:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:57:09 | Server | Tor[4685]: message repeated 40 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:58:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:58:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 3:59:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 3:59:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:00:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:00:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:01:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:01:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:02:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:02:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:03:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:03:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:04:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:04:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:05:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:06:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:06:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:07:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:07:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:08:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:08:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:09:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:09:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:10:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:10:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:11:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:11:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:12:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:12:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:13:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:13:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:14:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:14:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:15:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:15:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:16:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:16:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:17:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:17:10 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:18:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:18:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:19:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:19:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:20:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:20:09 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 25 | 4:21:09 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 25 | 4:40:09 | Server | Tor[4685]: message repeated 57 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 2:16:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 2:16:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 2:16:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 2:17:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 2:20:14 | Server | Tor[4685]: message repeated 11 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 2:21:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 2:39:14 | Server | Tor[4685]: message repeated 56 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 2:40:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 3:04:14 | Server | Tor[4685]: message repeated 74 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 3:05:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 3:05:14 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 3:06:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 3:09:14 | Server | Tor[4685]: message repeated 11 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 3:10:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 3:10:14 | Server | Tor[4685]: message repeated 2 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 3:11:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 3:16:14 | Server | Tor[4685]: message repeated 15 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 3:16:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 3:16:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 3:17:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 3:45:14 | Server | Tor[4685]: message repeated 84 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 3:46:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 3:59:14 | Server | Tor[4685]: message repeated 39 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 4:00:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 4:05:14 | Server | Tor[4685]: message repeated 17 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 4:06:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 4:16:14 | Server | Tor[4685]: message repeated 30 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 4:16:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 4:16:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 4:17:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:05:15 | Server | Tor[4685]: message repeated 146 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 5:06:14 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:08:15 | Server | Tor[4685]: message repeated 8 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 5:09:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:14:15 | Server | Tor[4685]: message repeated 17 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 5:15:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:16:15 | Server | Tor[4685]: message repeated 3 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 5:16:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:16:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:17:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:29:15 | Server | Tor[4685]: message repeated 38 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 5:30:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:39:15 | Server | Tor[4685]: message repeated 29 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 5:40:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:44:15 | Server | Tor[4685]: message repeated 14 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 5:45:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:50:15 | Server | Tor[4685]: message repeated 17 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 5:51:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 5:56:15 | Server | Tor[4685]: message repeated 17 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 5:57:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 6:01:15 | Server | Tor[4685]: message repeated 14 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 6:02:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 6:05:15 | Server | Tor[4685]: message repeated 11 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 6:06:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 6:16:15 | Server | Tor[4685]: message repeated 30 times: [Possible compression bomb; abandoning stream.] |
> | Jul | 26 | 6:16:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 6:16:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 6:17:15 | Server | Tor[4685]: Possible compression bomb; abandoning stream. |
> | Jul | 26 | 6:21:15 | Server | Tor[4685]: message repeated 12 times: [Possible compression bomb; abandoning stream.] |
---
### Author:  [@MrRant](https://forum.torproject.org/u/MrRant)
#### Post date: [July 28, 2023, 6:05am UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/9 "2023-07-28T06:05:42Z")
Actually looks like I can’t upload my syslog as new user. 😃
---
### Author:  [@Vort](https://forum.torproject.org/u/Vort)
#### Post date: [July 28, 2023, 6:46am UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/10 "2023-07-28T06:46:23Z")
I have less of them:
```plaintext
Nov 02 06:08:50.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:08:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:09:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:09:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:09:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:10:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:10:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:10:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:11:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:12:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:12:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:12:59.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:13:58.000 [warn] Possible compression bomb; abandoning stream.
Nov 02 06:13:59.000 [warn] Possible compression bomb; abandoning stream.
Oct 06 03:25:05.000 [warn] Possible compression bomb; abandoning stream.
Jan 13 14:26:00.000 [warn] Possible compression bomb; abandoning stream.
May 15 07:07:54.000 [warn] Possible compression bomb; abandoning stream.
Jun 03 05:16:01.000 [warn] Possible compression bomb; abandoning stream.
Jun 28 21:26:07.000 [warn] Possible compression bomb; abandoning stream.
Jun 28 21:26:07.000 [warn] Possible compression bomb; abandoning stream.
Jul 02 01:28:09.000 [warn] Possible compression bomb; abandoning stream.
Jul 07 14:06:58.000 [warn] Possible compression bomb; abandoning stream.
Jul 09 14:04:36.000 [warn] Possible compression bomb; abandoning stream.
Jul 09 14:04:36.000 [warn] Possible compression bomb; abandoning stream.
Jul 09 14:04:36.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 05:25:44.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 05:25:45.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 06:16:45.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 07:23:46.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 07:24:45.000 [warn] Possible compression bomb; abandoning stream.
Jul 13 07:25:46.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:27.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:27.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:28.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:28.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:17:28.000 [warn] Possible compression bomb; abandoning stream.
Jul 17 01:18:26.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:06:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:06:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:06:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:07:02.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:07:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 25 03:07:03.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 03:30:23.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 03:30:23.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 04:26:23.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 04:26:24.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 04:27:23.000 [warn] Possible compression bomb; abandoning stream.
Jul 26 06:23:25.000 [warn] Possible compression bomb; abandoning stream.
```
Probably because I operate Guard node, not bridge.
---
### Author:  [@0xbytes](https://forum.torproject.org/u/0xbytes)
#### Post date: [July 28, 2023, 11:53am UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/11 "2023-07-28T11:53:23Z")
I agree with @Vort
Like you had said, could be either a bug or legitimate bombs. Probably best to check tor metrics for the IP associated with the ‘Unable to decompress HTTP body’ messages if you’re really curious.
---
### Author:  [@MrRant](https://forum.torproject.org/u/MrRant)
#### Post date: [July 28, 2023, 5:25pm UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/12 "2023-07-28T17:25:55Z")
Could someone point me in that direction?
---
### Author:  [@MrRant](https://forum.torproject.org/u/MrRant)
#### Post date: [July 29, 2023, 8:16am UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/13 "2023-07-29T08:16:48Z")
I don’t see this occurring in the last 24-36 or so hours as I look at the logs.
---
### Author:  [@Vort](https://forum.torproject.org/u/Vort)
#### Post date: [August 23, 2023, 4:33pm UTC](https://forum.torproject.org/t/possible-compression-bomb-abandoning-stream/8479/14 "2023-08-23T16:33:12Z")
Version 0.4.8.4 have fix related to this problem ([fd3f9e85](https://gitlab.torproject.org/tpo/core/tor/-/commit/fd3f9e858045068789603656f4fbd491c2b7dcbc)).