When applying netstat on a machine (Kali Linux 2016.2) running tor, I can observe an always established outbound ssh connection - see third line below. Could anyone confirm why this ssh connection is required? I thought Tor only makes HTTPS connection to nodes - it shouldn't require a consistent SSH connection.

The commands I ran were:

$ service tor start
$ netstat -atnp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0*               LISTEN      1604/tor            
tcp        0      0*               LISTEN      1604/tor            
tcp        0      0        ESTABLISHED

Tor version in use is as below:

$ tor --version
Tor version (git-8d8a099454d994bd).

The IP address you posted belongs to the relay c4k3KS1. As you can see at the Atlas page it listens at port 22 for Tor connections. So in your netstat view there is no real SSH session, but a Tor connection on port 22. You'll find several relays which listen on other ports. Usually port 80 or 443 are quite common. This helps to circumvent firewall settings on the client side.


No problem here - it's a foreign address, i.e. remote relay uses port 22 for it's operations. The local address is a column you should worry about in such suspicions. The pluggable transports jobs are also much more efficient if they're bounded to port 443 and mimicing a HTTPS connection.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.