#ls2 (irc2p) | #ls2 proposal review channel : Reviews Tuesdays 7 PM UTC: none scheduled

obscuratus orignal: To recap... This router was generating a storm of tunnel building. If you didn't implement limits, a single router might see 100s participating tunnel build requests from this one router.

orignal elgamal or ecies?

obscuratus Encryption Key:ECIES_X25519

orignal then why is it a problem?

orignal it doesn't consume too much cpu

obscuratus For my part, I had to degrade my routers service by imlementing tunnel limits. If I didn't, my router would crash.

obscuratus And this one router would crowd out other legimate tunnel requests.

orignal the question is

orignal how can they manage to produce so many requests?

orignal if they are real

obscuratus If I had to guess, they had a custom router build of some kind.

obscuratus Oddly, I never saw an OBEP or IBGW, just participating tunnels. Dozens of them.

orignal I mean how much cpu they use on their side

orignal huh? so you know what's inside that record?

orignal it means they encrypt it properly

obscuratus The traffic through each tunnel was pretty low, usually 20-40k over the life of a given tunnel. I never tried to examine the traffic to check if it was encrypted properly.

orignal since you know that your are a aprticipating tunnel

orignal it means you are able to decypt your record

obscuratus I never saw any glaring errors in my logs, so that seems like a good assumption.

orignal that means they have to do encryption job oon their side

obscuratus Also, the originating IP address of this router was changing. Rotating through several VPN addresses.

orignal maybe Turkmen?

orignal they keep using several VPNs

obscuratus According to eyedeekay, it was a provider called "Clouvider". Most of the vpn out points were in Europe.

eyedeekay That was just based on running whois against the IP addresses which were listed in dev yesterday

eyedeekay But yes, Clouvider, which is a corporation based in the UK

R4SAS windows MTU: I see 1492 on my windows box with Ethernet connection to router

R4SAS VirtualBox creates interfaces woth 1500

R4SAS somewhere in internet I see reports that they have 1280 on 6to4 adapters

R4SAS PPPoE has 1480

R4SAS orignal: hmm... GetMTUWindowsIpv6

R4SAS huh?

orignal idk

orignal I didn't write this code

R4SAS we already check interface MTU on windows

orignal anyway let's recognize tunnel brokers by IP

orignal yes I know

orignal maybe we do it worng

orignal nobody cared before

R4SAS what for?

orignal aboout HE mtu on windows

orignal it must be 1480

dr|z3d Clouvider provides services to HideMeVPN afaik.

dr|z3d do you do any part tunnel request throttling, orignal?

orignal no

orignal because I'm fine with it

R4SAS nope

R4SAS 1280 5 0 0 IP6Tunnel

dr|z3d ok, just curious. I think that specific router may have been spiking at several thousand part tunnel requests at various times.

orignal R4SAS it's default value

R4SAS nope, I just tried to add tunnel to HE

orignal dr|z3d it's not a problem for us really

orignal x25519 is really fast

R4SAS and system set that MTU automatically

orignal sure it's system rather than i2pd's?

dr|z3d could be an early warning sign of network abuse

R4SAS ???

orignal I doubt that that router is doing a network abuse

orignal where do you 1280?

orignal if ipconfig or in i2pd?

R4SAS >netsh interface ipv6 show subinterfaces

orignal then windows is fine ))

orignal zzz do we also publish mtu for SSU1 ipv4?

orignal or it's for ipv6 only?

dr|z3d > <zzz> you must, of course, publish non-default MTU for ipv4 also

orignal that's for SSU2

orignal I'm asking about SSU1

orignal I remeber it was a reson to not publish mtu for ipv4

dr|z3d ok, nothing explict I can see regarding SSU1 for MTU publication.

dr|z3d (in the backlog)

orignal it's long story

orignal since I see in the code

orignal I publish mtu for ipv6 addresses only

orignal no 2RRY in the list because it crashed ))

zzz orignal, yes, of course, ipv4 SSU 1 also

zzz since 0.9.2 2012

orignal then why I set it for ipv6 only?

zzz ipv6 can never be the default because it's mod 16 = 0

zzz ipv4 is mod 16 = 12, with a default 1484

zzz why you don't set it for non-default, only you can say

orignal idk either

orignal I will change it