peculiar server "bandwidth" posted by server "mnl" and possible new type of attack

[Kasimir Gabert]

On Tue, Sep 9, 2008 at 8:10 AM, Olaf Selke <olaf.selke at blutmagie.de> wrote:
> Scott Bennett wrote:
>>
>>      Nearly 49 MB/s seems a bit of a stretch.  The server's operator sent me
>> a note saying that the server is attached to the 1 GB/s campus backbone net,
>> but it is attached via a 100 Mb/s router, so the reported data rate is four
>> to five times the rate physically possible due to the router's limitation.
>> The server, according to its operator, is running on a 2.6 GHz P4, and its
>> descriptor says the machine is running LINUX.  Based upon postings quite a
>> while back from blutmagie's operator and from a few other operators of very
>> high-data-rate servers, it seems to me that a 2.6 GHz P4 (Northwood?) running
>> LINUX would not be capable of handling a load eight to ten times that of
>> blutmagie, regardless of its network connection's capacity.
>
> blutmagie tor node is running on a pair of the old Prestonia P4 NetBurst Xeon DP
> 3200MHz processors. Over the last four weeks mrtg monitoring is showing an
> average interface throughput of 32 MBit/s in and 33 MBit/s out. Throughput is
> limited by cpu power rather than by available network bandwidth. Since Tor
> doesn't scale very well with the number of cores, one core is loaded with 100%,
> leaving the other three cores almost idle. Compiling the openssl library with
> Intel's C compiler icc improved performance by about 20-25% compared with gcc
> (compiling tor with icc doesn't change very much). That's the reason blutmagie's
> observed data rate increased from about 5500 to nearly 7000 KByte/s some weeks ago.
>
> regards Olaf
>

Hello Olaf,

For the upcoming version of TorStatus, I followed Roger's suggestion
of calculating the observed bandwidth using the read and write history
instead of the given observed bandwidth rate.  After doing this, and
what seems to follow the graphs relatively accurately, your bandwidth
rate has dropped to 3463.39 KB/s.  I'm using a linear moving average
to calculate the bandwidth.  Would you mind looking over the new
router detail page and seeing if it looks reasonable to you?  You can
view it at http://trunk.torstatus.kgprog.com/router_detail.php?FP=795513a52e5155af5e36937d5a7c76d3bf20d0c4

Also, with regards to mnl, it is down now but I can remember that when
it was running I noticed how it was the lead by a large margin on the
current TorStatus page, but was at something like 200 on the trunk
page.  It seems like it never received the amount of traffic that it
could handle, or something similar.

Kasimir

-- 
Kasimir Gabert