Flooding, and how it gets reported
Why this class of attack is structurally cheap against hidden services, and what we will and will not publish about it.
Flooding is the most common attack on this beat and the least interesting to write about, which is a bad combination for readers. It produces long stretches of degradation with no story attached, so this page explains the shape instead.
Why it is cheap here
Reaching a hidden service is expensive for the client, by design. Building circuits and meeting at a rendezvous point costs real work at both ends. That symmetry is the problem. An attacker opening connections forces the service to do the matching work, and unlike a clearnet service under load it cannot drop traffic by source, because there is no source to drop by.
There is no equivalent of the mitigation services clearnet operators rely on. Nobody can sit in front of a hidden service and absorb junk, because the whole point of the architecture is that nothing sits in front of it. Defence has to happen at the service itself, in the same place doing the real work.
What it looks like from outside
Rarely a clean failure. The usual experience is degradation, since a service under this kind of load stays up while getting slower, so the user facing symptom is timeouts, hangs, and pages that partly render. Almost identical to ordinary congestion, which is why users cannot tell the difference and why we get asked.
It is also frequently address specific. An attacker floods addresses they know, and the newest address in a pool is often the one they have not scraped yet. That is why switching mirrors so often resolves what looks like an outage, and why the newest address is frequently the fastest one during an incident.
What we publish
- That an incident is happening, once we can distinguish it from congestion, which usually takes longer than readers would like.
- Which addresses are affected and which are not, since that is directly actionable.
- Rough duration once it has resolved.
What we do not publish
Anything specific about the defences. Not thresholds, not what triggers a limiter, not how a particular pattern is recognised. This is a real limitation on the reporting and we would rather state it than have readers assume we are simply not covering it.
The reason is direct. A precise description of how flooding is being absorbed is a description of what to change to get around it. Publishing operational detail about a live defence hands the attacker the one thing they lack, which is feedback on whether their approach is working. Readers lose some understanding and keep a working service, and that is the correct trade.
What to do while it lasts
Switch addresses first, since the newest is often untouched. Stop reloading, because every reload adds to the load the defence is trying to shed and moves you closer to a limiter. Then wait, which is genuinely the highest value action available. And treat any new address surfacing during the incident as unverified until you have checked its signature yourself, because this is exactly the window in which fakes get seeded.
Verified working Nexus Market mirrors
Three v3 onion addresses currently serving the production market, signed under PGP fingerprint 0x7F2A0A9D. Use the Copy buttons.