peculiar server "bandwidth" posted by server "mnl" and possible new type of attack

2008-09-09 Thread Scott Bennett
Over the last several days, a server nicknamed "mnl" has been posting descriptor updates bearing highly suspect data rate information. I have contacted the person at the contact-info address, so he is aware that the observed data rate (misnamed "bandwidth") reported in mnl's server descriptor

Re: peculiar server "bandwidth" posted by server "mnl" and possible new type of attack

2008-09-09 Thread Roger Dingledine
On Tue, Sep 09, 2008 at 05:15:15AM -0500, Scott Bennett wrote: > bandwidth 5242880 10485760 52239166 > ---> ~48.8 MB/s (!) Wow. Nice! :) And, as you say, unlikely to be true. > All of the above leads me to suspect two things. One is that there may > be s

Re: peculiar server "bandwidth" posted by server "mnl" and possible new type of attack

2008-09-09 Thread Scott Bennett
On Tue, 9 Sep 2008 06:42:02 -0400 Roger Dingledine <[EMAIL PROTECTED]> wrote: >On Tue, Sep 09, 2008 at 05:15:15AM -0500, Scott Bennett wrote: >> bandwidth 5242880 10485760 52239166 >> ---> ~48.8 MB/s (!) > >Wow. Nice! :) > >And, as you say, unlikely to be t

Re: peculiar server "bandwidth" posted by server "mnl" and possible new type of attack

2008-09-09 Thread Olaf Selke
Scott Bennett wrote: > > Nearly 49 MB/s seems a bit of a stretch. The server's operator sent me > a note saying that the server is attached to the 1 GB/s campus backbone net, > but it is attached via a 100 Mb/s router, so the reported data rate is four > to five times the rate physically pos

Re: peculiar server "bandwidth" posted by server "mnl" and possible new type of attack

2008-09-09 Thread Kasimir Gabert
On Tue, Sep 9, 2008 at 8:10 AM, Olaf Selke <[EMAIL PROTECTED]> wrote: > Scott Bennett wrote: >> >> Nearly 49 MB/s seems a bit of a stretch. The server's operator sent me >> a note saying that the server is attached to the 1 GB/s campus backbone net, >> but it is attached via a 100 Mb/s router

Re: Ports 465/587 in exit policy (was Re: Update to default exit policy)

2008-09-09 Thread Bill Weiss
F. Fox([EMAIL PROTECTED])@Sun, Sep 07, 2008 at 06:27:08PM -0700: > Bill Weiss wrote: > (snip) > > My Tor node runs a medium-load mail server as well, and I've never been > > blacklisted for spam stuff [1]. That seems like a decent indication of it > > not causing problems given how rabid the anti-

Re: peculiar server "bandwidth" posted by server "mnl" and possible new type of attack

2008-09-09 Thread Olaf Selke <[EMAIL PROTECTED]>
Kasimir Gabert wrote: > > Would you mind looking over the new > router detail page and seeing if it looks reasonable to you? You can > view it at > http://trunk.torstatus.kgprog.com/router_detail.php?FP=795513a52e5155af5e36937d5a7c76d3bf20d0c4 Sir, Yes Sir! It appears to be slighly below my mr

Reduced Tor Traffic [was: Re: peculiar server...]

2008-09-09 Thread Lucky Green
Roger Dingledine wrote: > On Tue, Sep 09, 2008 at 05:15:15AM -0500, Scott Bennett wrote: > > [...] >> That brings us back to something I've already posted on OR-TALK, namely, >> the apparent slowdown in tor traffic that has reduced the traffic through my >> tor server by at least 30% and, j

Re: Reduced Tor Traffic [was: Re: peculiar server...]

2008-09-09 Thread Gregory Maxwell
On Tue, Sep 9, 2008 at 8:02 PM, Lucky Green <[EMAIL PROTECTED]> wrote: [snip] > Also interesting to me is the overall reduced amount of traffic over the > last few months that I have been seeing with my middleman nodes. The > most likely explanation is that the overall Tor network capacity is exit

Re: Reduced Tor Traffic [was: Re: peculiar server...]

2008-09-09 Thread DM
Wouldn't the throughput of your server depend on the nodes up and downstream of it? On Sep 9, 2008, at 8:02 PM, Lucky Green wrote: Roger Dingledine wrote: On Tue, Sep 09, 2008 at 05:15:15AM -0500, Scott Bennett wrote: [...] That brings us back to something I've already posted on OR- TA