3

My tor exit node was 31.172.30.4:443 and at the same time I observed direct connection established to this IP 

TCP 192.168.1.xx:xxxxx->31.172.30.4:443 (ESTABLISHED)

Maybe my knowledge on tor is not as good as thought, but I'm quite sure it shouldn't happen. Security issue?

My setup: tor daemon running on Debian; all non-tor connections dropped.

Jens Kubieziel
  • 8,630
  • 5
  • 35
  • 116
justtoruser
  • 31
  • 1

1 Answers1

2

When you say "My tor exit node was 31.172.30.4:443", I presume you do not mean that you are the operator of the nicknamed chaoscomputerclub21 Tor node.

I think you mean that the Tor node in use as an exit node, for one or more of your Tor client's open circuits, was at that IP address.

Your Tor client will create multiple circuits at one time, and over time. Any node with Guard and Exit flags (chaoscomputerclub21 has both at the present time) could randomly be used as an entry guard, a middle node, and an exit. It being an exit in one circuit doesn't mean it can't be an entry guard in another, or a middle node in still another.

You should be able to use the tool (arm?) that showed you the chaoscomputerclub21 exit node selected for that one circuit to also see the entry and middle nodes. You can look at multiple circuits in that and probably see more than one instance of any given high capacity node showing up in various roles.

rdump
  • 511
  • 2
  • 8