[tor-relays] A new kind of attack?

[lists]

This seems to be related to what we already had in September:

Excessive / Unbalanced Relay Traffic

Hi all, I’ve been running Tor middle relays for well over a decade now so I like to consider myself pretty experienced with the trials and tribulations of being a relay operator. With that said, I’m seeing some unusual traffic patterns of late which are new to me and I’m wondering if anyone could shed any light on what may be the cause. My relay maurice (62BAB7516A0D3F1E6B2BC94767592791F6B58FB0), a virtual machine running on Proxmox VE, recently had an unscheduled restart due to a hardware fai…

It is always only intermittent and only some off my relays are affected.

Excessive / Unbalanced Relay Traffic

The fascinating thing is that it started at the same time and only ever affects the same relays. Of all my servers, only 2 are affected. Each one has 40 exit or guard instances running. Of the 40 guards, only one instance is affected: E1AF5373E3240566B598FA481AD3860549F6168B Of the 40 exits, only 4 instances are affected: BEE071E521A47C740C9F6184FEBCF78BFF5F1275 24FDF4754BB3775A6D54E078DCBBCA43D7B1B07E 4A169C0A14E41F647D009EC49D28A3D11629DAF0 A398080A6A72F828DC4476DE45E28C5892CA1070

···

On Montag, 15. Januar 2024 23:19:37 CET Chris Enkidu-6 wrote:

I've noticed a new kind of possible attack on some of my relays, as
early as Dec.23 which causes huge spikes of outbound traffic

I have included charts and excerpts from the log in my post in Tor forum
at below link:

New kind of attack?

--
╰_╯ Ciao Marco!

Debian GNU/Linux

It's free software and it gives you freedom!