At 19:34 10/24/2015 -0000, trshck_tor@riseup.net wrote:
On 2015-10-24 18:56, starlight.2015q3 at binnacle.cx wrote:
3000+ would be insanely large for relay rated around 100.
# lsof -Pn | grep "^tor" | grep ESTABLISHED | wc -l 3169 # netstat -nt | wc -l 1599
1600 is probably reasonable--is 25% of the relay population.
The 'lsof' number appears doubled. Probably the kernel in use is showing each socket once for each 'tor' process thread --two threads is the usual number.
You can obtain more detail by requesting a connection list on a control channel with
nc 127.0.0.1 9151 getinfo orconn-status
Authentication may be required by the control channel. I use AUTHENTICATE with a password but I think a token mechanism is the default (don't know how that works). Gruesome details here
https://gitweb.torproject.org/torspec.git/tree/control-spec.txt
Using <<EOF one can create small scripts for making control channel requests.
Output lines beginning with $ are relays. You may find user-client connections (IP only) because some old botnet is running a pre-guard version of tor or has disabled guards. For a middle relay only the peer relay count matters.