Analyze recent surge in users apparently stemming from Germany (starting around 06/11/2023)

Folks noticed that we have a surge of new Tor users apparently stemming from Germany. Might be worth analyzing what's going on using the tools we have available and if we lack some we could use that opportunity to get those needs onto our radar at least. Here is how things currently (begin of July 2023) look:

added Icebox label

Would we worth figuring out e.g. whether:

1. other countries are affected, too
2. performance is impacted
3. onion services are impacted
4. ...

changed title from Analyze recent surge in users apparently stemming from Germany (starting around 07/06/2023) to Analyze recent surge in users apparently stemming from Germany (starting around 06/11/2023)

5. that's a bug in our metrics code

/cc @hiro, @gus, @arma, @ahf

A hint from moria1's extra-info descriptor:

dirreq-v3-ips us=3656,de=2424,fr=920,nl=640
dirreq-v3-reqs de=58032,us=20264,fr=9464,nl=5792

That is, we are seeing more IP addresses in the US still, but more consensus fetches from Germany.

I think that means either more clients in Germany more often sharing the same IP address, or clients that restart a lot or something.

I would wonder if it's somebody with a client farm on e.g. hetzner, like we saw a few years back.

Very nice - @gk and I were talking about those numbers earlier today.

Some relevant data:

1. Bandwidth history didn't change

Bandwidth history graph - https://metrics.torproject.org/bandwidth.html

2. Spike on Directory requests of mirrors

Directory requests - https://metrics.torproject.org/dirbytes.html

3. Increase on v3 Onion Services traffic

onion services spike

FWIW, we have as well a thread in our forum about that: https://forum.torproject.org/t/sudden-sharp-increase-in-direct-tor-users-in-germany-1-5m/8164

mentioned in issue #62 (closed)

FWIW, compared to the surges mentioned in #62 (closed) the numbers for Germany stayed pretty high so far:

It looks like whatever it was ended on about 2024-05-06. Here are the global and Germany graphs.

https://metrics.torproject.org/userstats-relay-country.html?start=2023-05-01&end=2024-05-28&country=all&events=off

https://metrics.torproject.org/userstats-relay-country.html?start=2023-05-01&end=2024-05-28&country=de&events=off

mentioned in commit tpo/network-health/metrics/timeline@3f83bcb8

It looks like whatever it was ended on about 2024-05-06.

Correct. I gonna close this ticket for now as I don't plan to do any closer analysis on that German spike. We can re-open if someone is interested in doing more research/a closer investigation.

closed

Wake up babe. The sequel just dropped.
https://forum.torproject.org/t/new-spike-in-german-connections/15922?u=wofwca

marked this issue as related to #89