# Unknown Connections In Netstat

I have not ran TOR since turning on my computer hours ago. I occasionally netstat my CPU to make sure there is no unknown connections/phoning home/root kits.

I ran the following command:

 sudo netstat -natup 

This was in the output

 tcp 0 0 127.0.0.1:9050 0.0.0.0:* LISTEN 1324/tor tcp 0 0 10.8.0.2:53890 91.109.29.241:443 ESTABLISHED 1324/tor tcp 0 0 10.8.0.2:59096 185.13.38.75:9001 ESTABLISHED 1324/tor 

Anyone have any idea? Am I compromised?

• Pro-tip: You can't detect any good rootkit with netstat – cacahuatl Jan 1 '17 at 18:55

Those are both Tor relays.

91.109.29.241:443 and 185.13.38.75:9001 are both normal end-points for a Tor client to connect to.

Tor is likely running as a system service and configured as a client, which means it will start by default and it builds circuits opportunistically. It keeps a set of circuits open and ready for use. Even when you're not using it, it will be connected to the Tor network.

Running netstat will never be suitable to detect any rootkit, since netstat is executing in userspace and the rootkit is in the kernel, a rootkit can interfere with the information before it is fed back to netstat and remove itself from the listings. Infact that is standard functionality for rootkits, they won't appear in process listings, file listings or connection listings.

Your flawed attempt at security is both making you jump at shadows and not defeating attackers or detecting compromise.

It's OK - these ones are outbound connections, and it's totaly normal for Tor to have ones. You can post your torrc and ifconfig - so I'll be able to explain it in your particular case in much deeper details.

Tor opens connections to a Directory Server, telling you about Tor relays and your Entry Guards through which you use to connect to the middle and exit server.

If you are using the Tor Browser Bundle one of these IPs should match your entry guard.