0

I recently made a private Tor network using virtual machines (with this tutorial). The network is composed of three nodes:

  • goupix with the ip address 172.26.145.31
  • grodoudou with the ip address 172.26.145.32
  • grolem with the ip address 172.26.145.33

Moreover, grolem runs a directory server too.

The problem is, I have unexpected and yet unexplained opened socket on my VM's.

The nodes seem to communicate with each other, as shown by the following screenshot:

Opened sockets on my machines

Why 172.26.145.31 communicate with 172.26.145.32 ? I don't have any client requesting the building of a circuit, and yet two nodes communicate with each other.

Here you can see another screenshot of a tcpdump on goupix ( 172.26.145.31 ) communicating with grodoudou ( 172.26.145.32 ) :

Tcpdump on goupix

The length seems to be the size of Tor cells if you remove the headers.

Also, why there is a UDP socket "listening" on my machines, doesn't Tor communicate only via TCP? I didn't find any information on this.

  • Relays have to download new consensuses too. There will always be a little background traffic, even there are no clients. – pastly Mar 13 '18 at 8:36
1

Also, why there is a UDP socket "listening" on my machines

I think it's DNS (you can add DNSPort 5353 option in torrc and you will see).

The problem is, i have unexpected and yet unexplained opened socket on my VM's.

Look at your torrc for the following option "ORPort". It's external port for incoming tor connections. (in your torrc it uses 5000 port if you copy and paste torrc from guide, ofc).

Tor manual:

Advertise this port to listen for connections from Tor clients and servers. This option is required to be a Tor server. Set it to "auto" to have Tor pick a port for you. Set it to 0 to not run an ORPort at all. This option can occur more than once. (Default: 0)

  • I understand, but the network is private and not connected to the internet. Also, I don't have any client requesting the building of a circuit. – Anthony Mar 12 '18 at 6:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.