0

I was running Wireshark and noticed that my machine sends IMAP requests to 37.187.22.131, which, according to my TorBrowser, is the entry node I'm connected to. Likewise, my machine seems to be receiving IMAP responses from that IP as well. The responses seem to often happen in as low as ~30ms from the request. When I ping the entry node, the latency seems to be ~31ms. This leads me to believe that whatever requests my machine is sending, it is the entry node that is responding to them.

I installed another copy of TorBrowser, using a different entry node, and that doesn't seem to have the same problem. Also, when I'm not running a TorBrowser, there is no problem. The data that is being sent and received does not seem to be plain text either, so I don't think this is actual email traffic.

Does anyone know what is going on? I don't think I have any email services running in the background. Even if I did, why would the entry node respond to the requests? Is it possible that the 37.187.22.131 (and one of my copies of TorBrowser) is compromised? Or is IMAP (or IMAP looking) traffic normal for Tor behaviour?

Improve this question

1 Answer 1

Reset to default
2

I don't know if I can mark the question as solved since I am not registered, but here's the (I believe) correct answer: The issue seems to be that the entry node uses the same port as IMAP protocol, leading Wireshark to believe that the traffic is IMAP. Unfortunately, Wireshark doesn't seem to analyze headers by default, leading to this confusing issue.

Improve this answer
1
  • Infact wireshark cannot analyze the traffic, all it sees is TLS encrypted data and it's forced to go by the port, which is probably why the guard chose that port :) it looks like it could be email traffic.
    – cacahuatl
    Commented Jul 3, 2016 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .