Cat Tunnels Service Deploys Kotator-Rotator to Counter Mass Blocking of Relay Nodes in Russia

The operators of the decentralized Cat Tunnels service faced a sudden wave of blocks that disabled all several dozen of their tracker nodes inside Russia. Without these anchor relays, new user connections slowed dramatically and existing sessions degraded. The team responded by building Kotator-Rotator, an automated system that continuously evaluates node reachability from the client side and replaces failing relays with fresh instances. The decision engine relies on Grohotator, an aggregated availability metric derived from client technical logs that also triggers an audible alarm when thresholds are crossed. Analysis of the logs revealed that blocking activity follows a clear weekday pattern, pausing on Friday evenings and resuming Monday mornings. The experience demonstrated that server-side health checks alone are insufficient when censors interfere with paths between clients and relays.

HabrTranslated from Russian

Read at source

The operators of the decentralized Cat Tunnels service arrived at work expecting a routine day until the director burst in with reports that users across Russia could no longer connect reliably.

Although the service is designed to be decentralized, it still depends on a set of tracker nodes that help new clients locate entry points. At the time of the incident, several dozen such nodes were running in different countries, providers, and data centers. Every single one of them was blocked inside Russia.

The team began manually spinning up replacement servers, only to see each new instance blocked within minutes. This reactive approach proved unsustainable, leading to the development of Kotator-Rotator.

Kotator-Rotator continuously monitors relay availability using statistics collected directly from clients. Nodes that consistently disappear from client views are automatically decommissioned and replaced. The more severe the blocking, the more aggressively the system rotates infrastructure.

The rotation threshold is governed by Grohotator, an aggregated metric calculated from client technical logs. When the value exceeds a defined limit, a loud siren sounds across the office floor. The metric proved essential because server-side checks showed all relays as healthy and reachable from the public internet; only client perspectives revealed the actual connectivity failures.

Review of the logs also uncovered operational patterns on the blocking side. Activity drops sharply on Friday evenings and resumes around 8 a.m. on Monday, suggesting the responsible teams follow standard working hours.

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Privacy & Surveillance

Maximizing iPhone Privacy: Essential Settings to Enable, Disable, and Verify Immediately
Top 10 Secure DNS Servers for Privacy, Threat Blocking and Ad Filtering in 2026
WebRTC IP Leaks Explained: Why Disabling the Protocol Harms Anonymity in Anti-Detect Browsers