I'm using TBB for GNU/Linux as client. Wireshark logged traffic coming from entry guard (port 443) and a less frequent traffic coming from other tor relay (port 9001). Searching over at https://torstatus.blutmagie.de/, both relays in question were listed using these ports as OrPorts. As far as I understand, there should be traffic coming only from relay serving as entry guard, with configured OrPort(443, 9001, etc.), and from one relay with configured DirPort serving as dir mirror. I'd like to know if this is normal and if I only misunderstood things. Many thanks!
There are many reasons this might happen, one might be to contact Directory Authorities or Fallback Directory Mirrors in cases where you don't have an up-to-date enough consensus to connect to the Tor network.
Another is that, while Tor prefers to use one specific guard it still keeps a set of guards and can sample that set of guards to ensure they're still reachable, and will use them if there is an issue with the reachability of the primary guard. (You can read more about it in the guard spec which defines this process).
So this isn't abnormal and is expected behaviour.
Okay, so now it's enough information to answer your question:
- Directory mirror is completely safe to be taken from literally anywhere, because it is just a set of database files that were digitally signed by the directories, and the dir keys are hardcoded. So any node can verify the signature before trusting the piece of data. This makes not just a way faster network experience - it also fights censorship, because you can take the copy from so many places from a constantly changing list of nodes - it's nearly-impossible and practically useless to censor them all.
- Relay with no guard flag is harmless either: Tor has already contacted the network through the entry guard and made sure that the relay is not blacklisted, stable and fast enough to serve you. The actual reason of the connection is being made can be quite different and depends on situation - but Guard is used to secure the vital data traffic to integrate your node into the network.