Re: another DirPort DoS attacker

2008-10-09 Thread Scott Bennett
On Wed, 8 Oct 2008 23:34:00 -0400 Roger Dingledine [EMAIL PROTECTED] wrote: On Tue, Sep 02, 2008 at 08:20:47AM -0500, Scott Bennett wrote: A short time ago, I found that 212.205.53.212 had several hundred open TCP connections to my tor server's DirPort, and very little relay traffic

Re: another DirPort DoS attacker

2008-10-08 Thread Roger Dingledine
On Tue, Sep 02, 2008 at 08:20:47AM -0500, Scott Bennett wrote: A short time ago, I found that 212.205.53.212 had several hundred open TCP connections to my tor server's DirPort, and very little relay traffic seemed to be getting past all of that. I've now taken steps to prevent such

Re: another DirPort DoS attacker

2008-09-03 Thread John Brooks
I would be very interested to see what is being sent over these connections. Since the directory is on port 443, it's possible that this is some proxy/vulnerability scanner getting confused and hammering your server thinking it's a webserver of interest. However, it should *not* be possible for

Re: another DirPort DoS attacker

2008-09-02 Thread Scott Bennett
On Tue, 2 Sep 2008 09:44:14 -0600 John Brooks [EMAIL PROTECTED] wrote: That is odd; I don't see what purpose a DoS against a specific directory/node would serve (unless you were specifically attacking a connection routed through that node, or trying to use latency attacks). Is it an exit