A Year Under Flood: Two Campaigns, Ten Episodes — and the One That Broke Our Streak
Correction, July 29, 2026. This post originally said 1AEO's overload stayed near zero through every episode, and that the network's worst day was July 12. Both are wrong. A tenth episode — a directory-write mode, July 19–24 — put 135 of our relays into overload, and the network peak is now July 21.
Our recent series treats the June–July 2026 circuit-building DoS as an event. Our counters, which reach back to July 2025, say it is a chapter: ten distinct episodes since September 2025, forming two major campaigns — autumn 2025 and summer 2026 — around smaller winter and spring floods. As of July 29 it is being wound down mode by mode, but it is not over.
Ten Episodes, Two Campaigns #
The quietest stretch in our data is August 2025. The floods begin abruptly on September 4–6, 2025, and that autumn campaign is still the year's biggest by raw rate: circuit rejections peaked near 1.6 billion per day, roughly 125x the quiet baseline (the median of our late-2025 quiet windows). Episodes then recur about monthly, cycling between circuit floods, onion-service (INTRODUCE2) floods, a malformed-circuit vector from late March 2026, and — newest — the directory-write mode of July 19–24, a mode inside the summer campaign rather than a separate flood. Three spring episodes were visible only in our telemetry. This is not an escalation ramp: by rate, 2026 has been the quieter year.
What the Network Saw #
Tor's public data tells the same two-campaign story. Relays declaring overload peaked at 835 (9.0% of the network) on September 29, 2025; the winter floods barely registered and the spring episodes not at all (≤74, below the 94 ordinary quiet 2026 days reach). Then the summer campaign topped out on July 21, 2026 at 1,330 relays (12.87%) — the largest network event of the year, 1.6x autumn's peak. It has eased steadily since, to 721 (7.07%) on July 27, the lowest since July 8. Yet its rejection rate on our fleet peaked at only ~5.7x baseline, about 22x below autumn 2025's.
The Tenth Episode Ended a Year-Long Streak #
From July 19 the flood added a mode nothing in the preceding year had used: it made relays transmit. Network-wide directory-serving traffic in Tor's public archives went from a ~185 TB/day baseline to 808.5 TB/day on July 22 (~4.4x), then closed hard on July 24. On our fleet the written-to-read ratio — 0.99 to 1.07 for the entire preceding year, through every wave — hit 2.145 at 12:00 UTC on July 23, then settled back to 1.02–1.04. Other operators reported the same signature in the same window.
That is the episode that broke our streak. 1AEO's overload count had sat at 2–4 relays every day for a year, through both 9–12% network events. On July 23 it went to 54, then 82, 90, 94 on July 26; the faster-refreshing Onionoo feed puts the true high at 92 relays at 06:00–09:00 UTC on July 27. These were two distinct events (July 23, 19:00–22:00 UTC and July 27, 08:00 UTC), not one echoing, and cumulatively 135 distinct relays, 13.0% of our fleet, reported overload at least once. The second event came three days after the directory-write mode itself had closed — the same memory-handler mechanism, without the write surge still running; what re-triggered it is not established from our data. The episode ended before the restart could obscure it: Tor's memory handler stopped firing at 03:00 UTC on July 28, three hours before a planned fleet-wide service restart, and no 1AEO relay has reported overload since 09:00 UTC that day.
The mechanism was not CPU: onionskin drops, TCP-connection exhaustion and rate-limit hits were zero every day of the window. What fired was Tor's own memory handler (MaxMemInQueues), evicting ballooning outbound cell queues — ~221 GB freed July 23, ~117 GB July 27, ~475 GB in all — and every invocation makes a relay self-report overload-general. So "overloaded" here is memory pressure reported, not a relay failing: all stayed up, none dropped out of the consensus, and kernel OOM kills have been zero for 13 straight days.
Why the Smallest Flood Did the Most Damage #
The 2025 floods were rejection floods: circuit requests that relays inspected, refused, and forgot. Nothing accumulated, and our fleet took zero memory impact even at 125x baseline. The summer 2026 campaign is the first to accumulate state instead of rate — its idle circuits stay open, spiking to ~21x baseline and repeatedly returning above ~13x across four weeks, where every earlier episode stayed near ~2x. Parked circuits balloon relay memory, producing the year's only kernel OOM kills (~31, journal-verified, all before July 13) and the evictions above. The year's smallest campaign by rejection rate produced its largest blast radius — and is the only one ever to move our own overload count.
Where It Stands, July 29 #
Malformed circuits stopped at 23:00 UTC on July 20 and now run at roughly 1/175 of their 17,182/second peak. The directory-write mode closed July 24 and has not returned. INTRODUCE2 rejections collapsed at 14:30 UTC on July 26, from 545/second to about 1/second — 72.62 million on July 25 down to 4.88 million on July 28. What remains is the mode the campaign started with: plain circuit rejection, 35.6–38.7 million per day, holding at that level through July 28 and showing no sign of stopping. The flood is down to its original vector, and still live.
How We Measured #
Fleet-side: our Prometheus archive of Tor's per-relay DoS-defense counters and circuit gauges, July 2025 onward, aggregated daily and shown only as multiples of per-metric quiet baselines; our 2025 telemetry covered ~65% as many relays, so 2025 levels are undercounts. Network-side: overload-general declarations and directory-write byte histories from Tor's public CollecTor archives, deduplicated per relay per day, plus the Onionoo feed for sub-daily resolution on our own relays. Partial days undercount, so CollecTor stops at July 27 and our telemetry at July 28. A planned fleet-wide service restart on July 28 clears Tor's in-memory overload state, so counts after that date are not comparable to earlier ones. Aggregate counters only — nothing is recorded about individual sources.
Related reading — this post is the year-long frame around our five-part series on the summer 2026 campaign: 1. The Tor Network Is Under a Circuit-Building DoS Wave — the network-wide view. 2. Anatomy of the Attack — the waves and vectors. 3. What It Actually Costs — the CPU and memory bill. 4. The Flood Below Tor — the kernel-level connection flood. 5. Defending Against Circuit-Building DoS — the fixes we're asking for.