I'm using TBB for GNU/Linux as client. Wireshark logged traffic coming from entry guard (port 443) and a less frequent traffic coming from other tor relay (port 9001). Searching over at https://torstatus.blutmagie.de/, both relays in question were listed using these ports as OrPorts. As far as I understand, there should be traffic coming only from relay serving as entry guard, with configured OrPort(443, 9001, etc.), and from one relay with configured DirPort serving as dir mirror. I'd like to know if this is normal and if I only misunderstood things. Many thanks!

  • please post your torrc config, the answer depends on it – Alexey Vesnin Jan 6 '18 at 21:07
  • @AlexeyVesnin ./Browser/TorBrowser/Data/Tor/torrc: pastebin.com/eVimrb73 – user20568 Jan 9 '18 at 22:38
  • ok! any torrc-defaults tweaks? please post it too – Alexey Vesnin Jan 9 '18 at 22:39
  • @AlexeyVesnin nope none, but I've changed couple of entries in about:config (javascript.enabled;false, plugin.state.java;0, plugin.state.flash;0) , and removed HTTPS Everywhere addon – user20568 Jan 10 '18 at 21:01
  • Removing HTTPS Everywhere will make you look different from every other Tor Browser user and make your easier to track. – cacahuatl Jan 10 '18 at 22:16

There are many reasons this might happen, one might be to contact Directory Authorities or Fallback Directory Mirrors in cases where you don't have an up-to-date enough consensus to connect to the Tor network.

Another is that, while Tor prefers to use one specific guard it still keeps a set of guards and can sample that set of guards to ensure they're still reachable, and will use them if there is an issue with the reachability of the primary guard. (You can read more about it in the guard spec which defines this process).

So this isn't abnormal and is expected behaviour.

  • @ yes but there were no guard switching – user20568 Jan 12 '18 at 22:32
  • y, see the part about "sampling" – cacahuatl Jan 12 '18 at 22:33
  • there's a mistake: directory mirrors are contacted via DirPort - that's what it for, not via OrPort... – Alexey Vesnin Jan 18 '18 at 15:59
  • Depends, you can fetch directory stuff directly over the ORPort, DirPort is kind of being deprecated. – cacahuatl Jan 18 '18 at 22:46

Okay, so now it's enough information to answer your question:

  • Directory mirror is completely safe to be taken from literally anywhere, because it is just a set of database files that were digitally signed by the directories, and the dir keys are hardcoded. So any node can verify the signature before trusting the piece of data. This makes not just a way faster network experience - it also fights censorship, because you can take the copy from so many places from a constantly changing list of nodes - it's nearly-impossible and practically useless to censor them all.
  • Relay with no guard flag is harmless either: Tor has already contacted the network through the entry guard and made sure that the relay is not blacklisted, stable and fast enough to serve you. The actual reason of the connection is being made can be quite different and depends on situation - but Guard is used to secure the vital data traffic to integrate your node into the network.
  • for example, what would be the purpose connecting to other non guard relays if tor is used as client only? – user20568 Jan 10 '18 at 21:18
  • hidden service access – Alexey Vesnin Jan 10 '18 at 21:21
  • This isn't true. – cacahuatl Jan 10 '18 at 22:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy