Hello.
Tor at 1AEO wrote:
It's directory serving
Is the attack coming from the same few IPs? Would rate-limiting output
(with a very generous burst allowance) per-IP be effective here?
I assume these different attack patterns are tests from the attacker,
and the remaining circuit-building attack is just the one that they have
determined is the one that is the most effective?
Regards,
forest
···
_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org
A simple mitigation I used while my relay was under attack was the following. After noticing the unusual traffic, I enabled the option shown in [1] and then reloaded the affected Tor instance using the command in [2]. I left the instance in this state for approximately five minutes.
Immediately after the reload, the abnormal traffic stopped. I then commented out the option shown in [1] in the torrc configuration file and reloaded the instance once again using the command in [2]. In this way, the attack was effectively interrupted.
During this short interval of approximately ten minutes, my relay did not lose any of its flags. It appears that the attack tool was unable to determine that it should resume targeting the relay after the temporary interruption.
[1]
DirCache 0
[2]
systemctl reload tor@relay2.service
···
_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org