Help to understand Chutney

Question

I'm trying to perform some experiments with chutney, it actually works fine, but I have some questions about I can use it for my scope. In particular, I want (first of all) discover the path that my package do through the tor network (node by node). I tried to send data with curl and in particular curl --socks5 127.0.0.1:9000 www.torproject.org and I capture the output via Wireshark, I notice that the traffic pass through wlan0 (my wlan) and nothing pass on loopback, another thing that I notice is that on Wireshark the get request come from an IP that isn't mine, and I don't understand why. Continuing, since I want to see the package through the tor network, I decided to create an http server on 127.0.0.1:12058 with python python3 -m http.server 12058 and I sent a request via curl again curl --socks5 127.0.0.1:9000 127.0.0.1:12058, now the traffic pass through loopback, but I can't follow the package because the Ips of client, realys and exit are the same 127.0.0.1 and what change is the port. From what I know, there exists 4 types of port:

• ControlPort that can be used with nyx or other tool to control the traffic
• OrPort that is used by the nodes to send packets
• DirPort that is used by AD to send informations such as consensus
• SockPort used by the client to connect to the network

Standing on these informations, when I send a request to my http server I might see a lot of 127.0.0.1 that communicates each other with 9000 (sockport) for the client, orports for the relays and the exit node and the dirport for the DA, but what I see is different, infact the ports seems to be random and different from the ones wrote on the torrc (something like: 41126 or 34450) so I cannot follow the package.

Do you know why? Do you know how can I follow the package through the network? (maybe another tool or something like that) Am I doing something wrong?

Answer 1

First of all - you can not see the exit node's IP in your WireShark: it's encapsulated inside a 3-layered "onion". What you can see is:

• A guard node(s) that are used to Enter Tor network by your tor instance
• A nodes used for p2p connect for a first hop to make an onion pipe
• Directories you're talking to for Tor's consensus
• Other Tor nodes that are getting your directory mirror data - you SHOULD do it if you can forward a port or open one, it really helps the network

Yes - sometimes in a very rare case - you can see the connection to the node that is also an exit node you've used but it's a node-to node connection, not your exit one unless you have enabled a single-hop circuits. SHC's are gravely bad for privacy - use them as a last resort option!

127.0.0.1-stuff is how your software interacting with Tor as with any other SOCKS5s/SOCKS5h proxy. Don't use it as just SOCKS5 one - or you will need to use Tor's DNS port too and it's a potential DNS leak place unless it's properly handled by your firewall rules.