7

When I use Tor circuit during last few months I use ip-check.info site to verify my IP address in addition to check.torproject.org site. What I have noticed is that occasionally I get two IP addresses simultaneously. This phenomenon becomes more pronounced when I use bridges to connect to Tor. I have documented an example of this phenomenon. Below please find an example:

  1. check.torproject.org showed that my IP Address appear to be 185.2.138.125
  2. ip-check.info showed that my IP Address is 185.2.138.125 but in addition to that it shows that 46.149.23.63 (FTP) is my address and declares that I am not secure.

Is there something fishy going on. Am I being observed by third party? Is there a MITM?

Jens Kubieziel
  • 8,630
  • 5
  • 35
  • 116
Roya
  • 3,240
  • 3
  • 19
  • 40

2 Answers2

4

It's particularly not surprising to see different exit IPs for different protocols. This previous question of mine discusses this partially.

Essentially each connection to the net looks for a circuit that supports that protocol. If there's an circuit already waiting with that port open (and it's less than 10 minutes old) then Tor will re-use that. If not then Tor will grab a new circuit and use that instead.

Sometimes you'll connect to multiple servers over multiple protocols with the same circuit (and same exit node), but sometimes you'll end up with multiple circuits and this is completely normal.

Andrew Lott
  • 2,754
  • 5
  • 29
  • 46
3

No, everything is fine.

Tor is creating Circuits consisting of an entry-node, some middle-nodes and an exit node. Usually your entry-node is a guard node and is your first contact point to the Tor network. The middle-nodes are relays which just relays your traffic. The exit node will then communicate for you with the "real" world.

Usually connections to the same Server are done through the same Circuit, in your case you are contacting different servers so Tor is creating at least one Circuit for each server you want to connect to, and as Tor tries not to use the same Tor-routers twice it is good to see that your IP changes.

Roya
  • 3,240
  • 3
  • 19
  • 40
B4dT0bi
  • 399
  • 2
  • 7