About two weeks ago I started to notice strange dips on connection count graph for my relay (I’m using self-created monitoring software).
At 15 minutes mark of each hour about 1k-2k connections was dropped (and then recovered during several minutes).
Yesterday, however, there was no recovery after such drop. Also relay lost much more connections this time (about 6k - half of all connection relay usually had).
After this event, NTor (v3) values in log significantly degraded (from 700k-900k to 14k-15k).
There are two questions from me regarding this situation:
Did anyone else noticed such events for their relays?
How to figure out what happened? Did my software or hardware failed? Did my ISP introduced new form of censorship? Strange thing is that other software (besides Tor relay) works as good as before.
Drops occurring at exact 15-minute intervals usually point to something like ISP connection-tracking resets, stateful middlebox flushes, or a sudden consensus flag change rather than local hardware failure.
A few quick things worth checking:
Tor Metrics: Look up your fingerprint on Metrics to see if you lost the Guard or Fast flag or experienced a drop in consensus weight around that time. A sharp decline in NTor handshakes usually happens when clients stop selecting the relay for new circuits.
System Resources: Check your ulimit -n and sysctl settings alongside Tor’s notice logs to make sure you aren’t silently hitting file descriptor or socket limits.
TCP States: Run ss -s or conntrack right at the 15-minute mark to see if connections are getting actively reset (RST) by an upstream middlebox or just timing out.
Then several 2k drops happened followed by recovery periods (drop for about 4 hours then recovery for about 4 hours).
Also I now need to clarify that during 6k drop (which lasted about 29 hours) there were no short 1k dips.
Regarding your suggestions:
Flags and weight were fine;
There is no such problem on Windows host;
There are no such commands for Windows host. But your suggestion gave me an idea.
Instead of ss and conntrack I ran Wireshark at 15 minute mark.
I was able to catch pack of RSTs. However, I was not expected to figure out that it was possible to have about 1 thousand connections not from relays, but from user. This user owns several /24 subnets and from each IP address there are several simultaneous connections.
Now I’m not sure if short 1k drops and long 6k and 2k drops have the same origin. I probably should not worry about short ones (it’s just strange user activity), but long ones are still a mystery.