On Mon, Dec 07, 2015 at 09:57:18PM +0000, nusenu wrote:
and every column is a relay. White pixels mean that a relay was offline and black pixels means that a relay was online. Red pixels are used to highlight suspiciously similar clusters.
I assume they are highlighted only if they exceed a certain group size? What is the threshold?
Exactly. Groups >= 5 are considered for highlighting.
Until I looked at the heartbleed example I assumed grouping requires "perfect matches" across the entire month but after seeing the heartbleed example I'm not sure whether that is actually the case or if two distinct groups are just next to each other and do not have a "separator" between them.
Right, I don't use perfect matching, so we can account for some noise, e.g., some of the Sybils having small downtimes, or not starting and stopping at the exact same hour. Here's the code: https://gitweb.torproject.org/user/phw/sybilhunter.git/tree/uptime.go#n247
I would also find it useful to have it accept fingerprints as input and graph their uptime to look at a given set of relays in certain cases
example input could be the fingerprints from [1]+[2] after these relays have been around for some time.
Good point. That has been on my todo list and I hope to get it done soon.
Are you planing to generate these graphs on an ongoing basis?
Yes, I would like to. We could easily generate them every other hour, or even hourly. The details will depend on this thread, Karsten started: https://lists.torproject.org/pipermail/tor-dev/2015-December/010017.html
Cheers, Philipp