My tor exit node was and at the same time I observed direct connection established to this IP

TCP 192.168.1.xx:xxxxx-> (ESTABLISHED)

Maybe my knowledge on tor is not as good as thought, but I'm quite sure it shouldn't happen. Security issue?

My setup: tor daemon running on Debian; all non-tor connections dropped.

  • 3
    What program produced the output above?
    – Jens Kubieziel
    Commented Feb 4, 2014 at 23:01
  • So is the public IP address of the exit node. --- Do you know what is the machine with the private IP address 192.168.1.xx? What is running on the port 443 on your exit node? To see which process created the TCP connection run this command on the source machine (192.168.1.xx): sudo netstat -apnet | grep -F Run it as root if you do not have (configured) sudo. Commented Feb 5, 2014 at 11:24
  • Also is the public IP address configured directly on the exit node machine or is it configured as a static NAT? Where is the private address machine (192.168.1.xx) in the network topology related to the exit node machine and the possible NAT device? --- Are there any DNS records for the exit node IP address Commented Feb 5, 2014 at 11:34

1 Answer 1


When you say "My tor exit node was", I presume you do not mean that you are the operator of the nicknamed chaoscomputerclub21 Tor node.

I think you mean that the Tor node in use as an exit node, for one or more of your Tor client's open circuits, was at that IP address.

Your Tor client will create multiple circuits at one time, and over time. Any node with Guard and Exit flags (chaoscomputerclub21 has both at the present time) could randomly be used as an entry guard, a middle node, and an exit. It being an exit in one circuit doesn't mean it can't be an entry guard in another, or a middle node in still another.

You should be able to use the tool (arm?) that showed you the chaoscomputerclub21 exit node selected for that one circuit to also see the entry and middle nodes. You can look at multiple circuits in that and probably see more than one instance of any given high capacity node showing up in various roles.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .