Community analysis details HSDir flood patterns affecting ~300 Tor relays

Thu, 29 Oct 2026 05:50:14 GMT

A community report on the tor-relays mailing list presents custom metrics from approximately 300 relays, identifying 30 distinct flood windows over 48 hours. The data indicates that descriptor fetching and HTTP-wait closures dominated the traffic, with one relay recording over 14 million fetches. The report notes that Tor 0.4.9.15 is expected to rate limit some of these requests, while a separate incident report describes a relay experiencing memory exhaustion and OOM termination during a similar period.

Why it matters: The detailed metrics provide specific evidence of the traffic composition during recent network-wide resource exhaustion events, helping to distinguish between different types of flood attacks and validate the effectiveness of upcoming rate-limiting measures.

Reported · High priority · Developing

[tor-relays] Re: Shutting down my ~40 guards lists.torproject.org

Reported sustained circuit-building DoS wave on Tor network since June 2026

Mon, 13 Jul 2026 15:19:45 GMT

A relay operator reports a sustained circuit-building DoS against their guard relay family starting June 25, 2026, characterized by an 8x sustained increase in open circuits and a 20x peak. The attack involved millions of near-idle circuits and onionskin processing spikes across multiple regions, with bandwidth increasing only 20%. While DoS defenses engaged and prevented TCP port exhaustion, EU relays shed 10-20% of real traffic due to capacity constraints.

Why it matters: The report suggests the pattern is network-wide or family-targeted, and notes that EU relays shed 10-20% of real traffic.

Reported · High priority · Developing

Circuit-building DoS wave since 2026-06-25: 20x peak, 8x sustained open circuits on guard relays gitlab.torproject.org

Onion Flash · Relays

Community analysis details HSDir flood patterns affecting ~300 Tor relays

Reported sustained circuit-building DoS wave on Tor network since June 2026