I'm using TBB for GNU/Linux as client. Wireshark logged traffic coming from entry guard (port 443) and a less frequent traffic coming from other tor relay (port 9001). Searching over at https://torstatus.blutmagie.de/, both relays in question were listed using these ports as OrPorts. As far as I understand, there should be traffic coming only from relay serving as entry guard, with configured OrPort(443, 9001, etc.), and from one relay with configured DirPort serving as dir mirror. I'd like to know if this is normal and if I only misunderstood things. Many thanks!
-
please post your torrc config, the answer depends on it– Alexey Vesnin ♦Commented Jan 6, 2018 at 21:07
-
@AlexeyVesnin ./Browser/TorBrowser/Data/Tor/torrc: pastebin.com/eVimrb73– user20568Commented Jan 9, 2018 at 22:38
-
ok! any torrc-defaults tweaks? please post it too– Alexey Vesnin ♦Commented Jan 9, 2018 at 22:39
-
@AlexeyVesnin nope none, but I've changed couple of entries in about:config (javascript.enabled;false, plugin.state.java;0, plugin.state.flash;0) , and removed HTTPS Everywhere addon– user20568Commented Jan 10, 2018 at 21:01
-
Removing HTTPS Everywhere will make you look different from every other Tor Browser user and make your easier to track.– cacahuatlCommented Jan 10, 2018 at 22:16
|
Show 1 more comment
2 Answers
There are many reasons this might happen, one might be to contact Directory Authorities or Fallback Directory Mirrors in cases where you don't have an up-to-date enough consensus to connect to the Tor network.
Another is that, while Tor prefers to use one specific guard it still keeps a set of guards and can sample that set of guards to ensure they're still reachable, and will use them if there is an issue with the reachability of the primary guard. (You can read more about it in the guard spec which defines this process).
So this isn't abnormal and is expected behaviour.
-
@ yes but there were no guard switching– user20568Commented Jan 12, 2018 at 22:32
-
-
there's a mistake: directory mirrors are contacted via DirPort - that's what it for, not via OrPort...– Alexey Vesnin ♦Commented Jan 18, 2018 at 15:59
-
Depends, you can fetch directory stuff directly over the ORPort, DirPort is kind of being deprecated. Commented Jan 18, 2018 at 22:46
Okay, so now it's enough information to answer your question:
- Directory mirror is completely safe to be taken from literally anywhere, because it is just a set of database files that were digitally signed by the directories, and the dir keys are hardcoded. So any node can verify the signature before trusting the piece of data. This makes not just a way faster network experience - it also fights censorship, because you can take the copy from so many places from a constantly changing list of nodes - it's nearly-impossible and practically useless to censor them all.
- Relay with no guard flag is harmless either: Tor has already contacted the network through the entry guard and made sure that the relay is not blacklisted, stable and fast enough to serve you. The actual reason of the connection is being made can be quite different and depends on situation - but Guard is used to secure the vital data traffic to integrate your node into the network.
answered Jan 10, 2018 at 21:03
-
for example, what would be the purpose connecting to other non guard relays if tor is used as client only?– user20568Commented Jan 10, 2018 at 21:18
-
-