[tor-dev] Dir auths using 2x bandwidth in last week

[David Fifield]

On Sun, Sep 17, 2017 at 07:32:13PM -0400, Roger Dingledine wrote:
> On Wed, Aug 09, 2017 at 11:36:27PM -0400, Roger Dingledine wrote:
> > https://atlas.torproject.org/#details/9695DFC35FFEB861329B9F1AB04C46397020CE31
> > https://atlas.torproject.org/#details/F2044413DAC2E02E3D6BCF4735A19BCA1DE97281
> > https://atlas.torproject.org/#details/BD6A829255CB08E66FBE7D3748363586E46B3810
> > https://atlas.torproject.org/#details/74A910646BCEEFBCD2E874FC1DC997430F968145
> > https://atlas.torproject.org/#details/7EA6EAD6FD83083C538F44038BBFA077587DD755
> > all show a big increase in sent bytes starting at the end of July.
> > 
> > It isn't growth in Tor users, since those have stayed relatively flat
> > in the last two weeks.
> > 
> > And the new rate seems to be the new normal -- it's showing no signs of
> > going back to the old rate.
> > 
> > I would assume it's outgoing directory stuff, since that's most of what
> > dir auths do.
> > 
> > Any guesses?
> 
> Well, whatever it was, it settled out -- back to normal -- once August
> ended.
> 
> https://atlas.torproject.org/#details/9695DFC35FFEB861329B9F1AB04C46397020CE31

The start and end of the doubling of dirauth bandwidth coincide with a
temporary doubling or tripling of reported users from the Netherlands:

https://people.torproject.org/~dcf/metrics-country.html?start=2017-07-01&end=2017-09-30&country=nl

There is a somewhat similar pattern in the Seychelles, Lithuania, and
Romania, all of which had unexplained increases at the same time as the
Netherlands.

https://lists.torproject.org/pipermail/metrics-team/2017-August/000428.html
https://people.torproject.org/~dcf/metrics-country.html?start=2017-07-01&end=2017-09-30&country=sc
https://people.torproject.org/~dcf/metrics-country.html?start=2017-07-01&end=2017-09-30&country=lt
https://people.torproject.org/~dcf/metrics-country.html?start=2017-07-01&end=2017-09-30&country=ro