Hi, I'm highly suspicious of commit 3e18507dc75afcf0c6560e966c9f18942406b0c8 which adds a call to geoip_note_client_seen with a NULL (==no PT) in src/core/or/channeltls.c
It's fine for DoS defense, but it's likely what's messing up stats. Regards, trinity-1686a On Tue, 3 Oct 2023 at 21:12, David Fifield <da...@bamsoftware.com> wrote: > > The Snowflake bridges do not expose their plain ORPort (they have > `ORPort 127.0.0.1:auto` in torrc), and consequently they have always > reported ≈0 <OR> IP addresses in the bridge-ip-transports line of > bridge-extra-info descriptors, with virtually all connecting IP > addresses being instead attributed to the snowflake transport. (The <OR> > count is low but nonzero, which I have rationalized as tor making some > small number of internal connections, or something.) > > I upgraded one of the two Snowflake bridges from 0.4.7.13 to 0.4.8.6 on > 2023-09-24. Since then, the number of <OR> IP addresses has been roughly > equal to the number of snowflake IP addresses. The ORPort is still not > exposed; these are not external vanilla bridge users. Did something > change between these versions that might cause PT connections to be > double-counted, once for the transport and once for <OR>? > > Here are excerpted bridge-extra-info descriptors from before and after > the version upgrade. Note the bridge-ip-transports lines. > > ``` > @type bridge-extra-info 1.3 > extra-info crusty5 91DA221A149007D0FD9E5515F5786C3DD07E4BB0 > master-key-ed25519 1y9CAtinlbrhDuYBSOBNiCU9Ck1lcY7LErxnzhtxVks > published 2023-09-19 10:46:08 > transport snowflake > bridge-ip-versions v4=13528,v6=1384 > bridge-ip-transports <OR>=8,snowflake=14912 > ``` > > ``` > @type bridge-extra-info 1.3 > extra-info crusty5 91DA221A149007D0FD9E5515F5786C3DD07E4BB0 > master-key-ed25519 1y9CAtinlbrhDuYBSOBNiCU9Ck1lcY7LErxnzhtxVks > published 2023-09-29 17:33:20 > transport snowflake > bridge-ip-versions v4=2880,v6=336 > bridge-ip-transports <OR>=1632,snowflake=1592 > ``` > > Below is a time series for a whole month. > The thing to notice is not the overall decrease in users on 2023-09-20; > that's due to > https://forum.torproject.org/t/problems-with-snowflake-since-2023-09-20-broker-failure-unexpected-error-no-answer/9346. > Rather, the thing to notice is that before 2023-09-24, <OR> ≈ 0; and > after, <OR> ≈ snowflake. > > date <OR> snowflake > 2023-08-30 4 45240 ← running 0.4.7.13 here > 2023-08-31 21 193412 > 2023-09-01 30 195647 > 2023-09-02 40 200405 > 2023-09-03 40 201730 > 2023-09-04 42 195097 > 2023-09-05 35 190842 > 2023-09-06 30 189694 > 2023-09-07 26 191524 > 2023-09-08 35 195833 > 2023-09-09 32 196244 > 2023-09-10 27 146972 > 2023-09-11 6 55491 > 2023-09-12 18 182519 > 2023-09-13 17 173536 > 2023-09-14 21 161396 > 2023-09-15 21 166379 > 2023-09-16 16 174350 > 2023-09-17 17 165063 > 2023-09-18 23 164734 > 2023-09-19 32 164075 > 2023-09-20 23 121623 > 2023-09-21 2 25268 > 2023-09-22 0 4314 > 2023-09-23 0 746 > 2023-09-24 239 606 ← upgrade to 0.4.8.6 on this day > 2023-09-25 1919 1900 > 2023-09-26 3533 3470 > 2023-09-27 11919 11687 > 2023-09-28 20242 19890 > 2023-09-29 26583 26100 > 2023-09-30 25929 25400 > _______________________________________________ > tor-dev mailing list > tor-dev@lists.torproject.org > https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev _______________________________________________ tor-dev mailing list tor-dev@lists.torproject.org https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-dev