[tor-dev] Possible anomaly in meek user graph circa April 15, 2015

[David Fifield]

The latest meek user graph shows two recent large increases. The first
increase from 2000 to 3000 is around April 9. The second from 3000 to
5000 is all on April 15. The first increase makes sense; it corresponds
with the removal of a bottleneck on meek-azure:
https://lists.torproject.org/pipermail/tor-dev/2015-April/008637.html
The second one happens all in one day and I don't have an explanation
for it.

Here are the day-by-day numbers, the same numbers from which the graph
is derived:
                            ↓↓
2015-04-09,bridge,,meek,,,,2584,54
2015-04-10,bridge,,meek,,,,3363,54
2015-04-11,bridge,,meek,,,,3392,51
2015-04-12,bridge,,meek,,,,3531,52
2015-04-13,bridge,,meek,,,,3344,49 ←
2015-04-14,bridge,,meek,,,,5385,53 ←
2015-04-15,bridge,,meek,,,,5113,52
2015-04-16,bridge,,meek,,,,4990,52
2015-04-17,bridge,,meek,,,,5173,51
2015-04-18,bridge,,meek,,,,5422,33

I at first suspected conflation with the statistics of some other
transport, like we observed with meek and websocket back in September
2014.
https://lists.torproject.org/pipermail/tor-dev/2014-September/007483.html
There is a nearly simultaneous increase in obfs4 (also attached); I
didn't see anything similar in any other transports. However I checked
Onionoo and the only bridges running meek are ones I know about, and
they aren't running any other transports.

https://onionoo.torproject.org/details?type=bridge
{"nickname":"UtahMeekBridge","hashed_fingerprint":"88F745840F47CE0C6A4FE61D827950B06F9E4534","or_addresses":["10.45.162.225:8000"],"last_seen":"2015-04-20 19:48:46","first_seen":"2014-10-24 20:37:04","running":true,"flags":["Fast","Guard","Running","Stable","Valid"],"last_restarted":"2015-04-13 19:14:56","advertised_bandwidth":6517470,"platform":"Tor 0.2.5.12 on Linux","transports":["meek","meek"]},
{"nickname":"TorLandMeek","hashed_fingerprint":"55CD4494A9EC14B74A677A7B7DD356E3417F9E69","or_addresses":["10.60.60.122:443"],"last_seen":"2015-04-16 17:45:30","first_seen":"2015-04-15 18:44:44","running":false,"flags":["Valid"],"last_restarted":"2015-04-15 18:24:47","advertised_bandwidth":3540992,"platform":"Tor 0.2.5.10 on Linux","transports":["meek"]},
{"nickname":"starman","hashed_fingerprint":"AA033EEB61601B2B7312D89B62AAA23DC3ED8A34","or_addresses":["10.243.156.101:9002","[fd9f:2e19:3bcf::24:d1d2]:9002"],"last_seen":"2015-04-20 19:48:46","first_seen":"2014-09-16 06:37:04","running":true,"flags":["Fast","Guard","Running","Stable","Valid"],"last_restarted":"2015-04-09 16:19:58","advertised_bandwidth":2434220,"platform":"Tor 0.2.5.12 on Linux","transports":["meek","meek"]},
{"nickname":"TorLandMeek","hashed_fingerprint":"3FD131B74D9A96190B1EE5D31E91757FADA1A4F3","or_addresses":["10.116.43.196:443"],"last_seen":"2015-04-20 19:48:46","first_seen":"2014-10-14 06:37:04","running":true,"flags":["Fast","Guard","Running","Stable","Valid"],"last_restarted":"2015-04-15 19:02:22","advertised_bandwidth":4125225,"platform":"Tor 0.2.6.7 on Linux","transports":["meek"]},

David
-------------- next part --------------
A non-text attachment was scrubbed...
Name: userstats-bridge-transport-meek-2015-01-20-2015-04-20.png
Type: image/png
Size: 10713 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20150420/b579b59e/attachment-0002.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: userstats-bridge-transport-obfs4-2015-01-20-2015-04-20.png
Type: image/png
Size: 10906 bytes
Desc: not available
URL: <http://lists.torproject.org/pipermail/tor-dev/attachments/20150420/b579b59e/attachment-0003.png>