Excessive Oxen Storage Server traffic on my server

[qdhj]

For a few weeks now my server is experiencing extremely high traffic from Oxen Storage Server (User-Agent: Oxen Storage Server/2.11.0).

• Number of requests: ~26,851,007
• Traffic volume: ~10.6 TB
• Share of total server traffic: ~99.9%
• Logs show almost exclusively POST requests to /oxen/v4/lsrpc
• All the groups together have no more than 11 gb of attachments

The Oxen network is essentially flooding the server with traffic, causing other services to receive very little resources. Moreover, even the rooms are working significantly slower for the last few weeks.

What is going on? Am I doing something wrong? Is it a problem in OXEN network? Or could it really be just so much files exchanged in my rooms?

It wasn't like that few weeks ago, and barely new rooms were created.

cat /var/log/nginx/access.log
[IP_REMOVED] - - [07/Sep/2025:19:41:47 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:47 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 82769 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:47 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:47 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:47 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 11168 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:47 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:47 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 3556779 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 146 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 4510523 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 12951 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 496 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 11446 "-" "node-fetch/1.0 (+https://github.com/bitinn/node-fetch)" [IP_REMOVED] - - [07/Sep/2025:19:41:48 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 2309 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 1107 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 653 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 2715 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 146 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:49 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 2029 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 374 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 3230 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 3442 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 1953 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 1131 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:50 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:51 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:51 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:51 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:51 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:51 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 200 6527 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:51 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:51 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0" [IP_REMOVED] - - [07/Sep/2025:19:41:51 +0000] "POST /oxen/v4/lsrpc HTTP/1.1" 503 190 "-" "Oxen Storage Server/2.11.0"

[jagerman]

This appears to be SOGS-specific traffic. All Session client requests are made via storage server onion requests, with an encrypted connection coming in to the /oxen/v4/lsrpc endpoint which decrypts and then handles the incoming request.

These logs look like nginx proxy logs, which aren't only going to contain that encrypted shell. The logs for SOGS itself should have more info.