Recent DDoS attacks caused me to update the DDoS solution [1] and to
roll it out to Tor instances using [2].
The metrics below shows the effect for the (highly overloaded vCPU
before), the throughput and the amount of protocol violations of a tiny
Tor cloud instance:
Another example is Tor instance at a bare metal server, attacked between
12 and 13 UTC (no Tor metrics during that time) and again after 16 UTC.
The new rule set was developed between 14 and 15, and fully applies
after a reboot at 15:20:
The graph below shows that the ipset (which holds malicious ip addresses
to be blocked) was not updated at the first attack.
But with the new rule set in place it was updated soon at the 2nd attack.
The yellow line in the 2nd graph shows the portion of the change.
And finally the DOS Tor metric for this instance indicates that the Tor
process has much less DOS to handle than before:
I'm still fine tuning the solution.
[1] https://github.com/toralf/torutils#the-rule-set
[2] https://github.com/toralf/tor-relays
--
Toralf
_______________________________________________
tor-relays mailing list -- [email protected]
To unsubscribe send an email to [email protected]
