The HSDir Population Was Still About 37% Below Its June Plateau on July 27
Correction, October 20, 2026: This post measures the HSDir relay population, not bandwidth capacity. The ratio chart compares relay counts, not actual load; the earlier 728-relay restart classification is withdrawn because its exact method could not be reconstructed.
Onion services depend on HSDirs (onion-service directories), which store descriptors containing introduction-point information. Clients fetch a descriptor when they lack a usable cached copy. HSDir eligibility requires directory support, Stable and Fast status, sufficient authority-assessed uptime (normally at least 96 hours), and reachability. This post tracks the flag population through July 27, 2026.
Three Steps Down, Then a Cliff #
Before the flood, the noon HSDir count sat on a plateau of 5,609–5,892 relays (June 15–21). It fell to 3,075 on June 30. The July 12 noon count was 1,942, with an hourly minimum of 1,780 at 20:00 UTC. July 20, 21 and 22 noon counts fell further: 1,662, 1,688 and 945. July 22’s hourly minimum was 917 at 09:00 UTC, the lowest in the May 1–July 27 archive window examined. Different included-vote counts limit comparisons between the two troughs.
Our planned July 11 maintenance restart temporarily reduced 1AEO’s HSDir count to zero. The figure shows both the full population and the population excluding 1AEO, so that maintenance is visible separately.
Then It Came Back — Most of the Way #
At July 23 05:00 UTC, 1,478 relays gained HSDir and 26 lost it, taking the total from 2,038 to 3,490. Of the gainers, 979 (66.2%) had held the flag exactly four days earlier. Noon counts then moved from 3,502 on July 23 through 2,548 and 2,612 to 3,749 on July 26 and 3,640 on July 27. That was 62.9% of the June 15–21 noon mean (5,787): about 37% below the plateau. July 27 itself was uneven, falling from 3,806 at 08:00 UTC to 3,416 at 23:00 UTC.
The recovery began before the July outbound directory-traffic surge ended; its cause remains unidentified. Our HSDir count also changed: 116 at July 22 noon, 711 on July 23 and 516 on July 27, including a rise from 340 to 707 across the July 23 05:00 UTC hour. The changes were not confined to our fleet.
A Flag Loss Does Not Establish a Restart #
A relay can lose HSDir without restarting. Authorities assess several eligibility conditions, including reachability and their own uptime history. Conversely, a continuing reported process uptime does not prove continuous reachability or uninterrupted circuits. Flag counts alone cannot separate these causes.
What It Means for Onion Services #
The chart divides the baseline non-1AEO count — 5,066.5, the June 17–24 hourly median — by each hour’s non-1AEO count. A ratio of 2 means half as many relays as at baseline. It reached 2.85 at the July 12 hourly trough and 6.29 at July 22 09:00 UTC. By July 27 it was 1.62 at noon and 1.72 at 23:00 UTC. These are ratios of population counts, not measured requests, bytes or each relay’s descriptor responsibility. The fleet’s late-June HSDir-cache pressure is a separate observation.
The July 27 population remained below its June plateau. Uptime and other eligibility requirements can delay recovery; a flag loss does not establish a process restart or a universal 96-hour reset.
How We Measured #
We count HSDir flags in every hourly consensus from June 14 through July 27; daily figures use 12:00 UTC unless labeled otherwise. The wider May 1–July 27 check includes May’s hourly minimum of 3,977. The non-1AEO grouping uses historical descriptor ContactInfo, as detailed with the plotted data below. Its baseline is the June 17–24 hourly median (5,066.5); using the wider June 1–24 median of 4,475 scales its ratios by about 0.88. The total-count shortfall is also baseline-sensitive: against the wider June 1–24 hourly median of 5,028, July 27 noon was 27.6% below baseline.
Seven authority votes were included from July 9 through July 20 16:00 UTC, apart from two single-hour readings of six. Eight were included from July 20 17:00–19:00, then nine at 20:00. HSDir needs more than half of the participating votes that recognize that flag. The number of included votes alone does not quantify its effect on the HSDir count.
Both figures deliberately end at July 27 23:00 UTC, before our separate July 28 maintenance restart. Frozen plotted data and methods · figure redraw script. The data records the historical contact grouping, missing-reference handling, fixed windows and source archive hashes.
Related reading: The Tor Network’s Circuit-Building DoS Wave in June–July 2026 — the network-wide view from Tor's public data. Anatomy of the Attack — including our first-party view of HSDir descriptor caches being pruned at their limits.