Private Tor network, socket explanation

Question

I recently made a private Tor network using virtual machines (with this tutorial). The network is composed of three nodes:

• goupix with the ip address 172.26.145.31
• grodoudou with the ip address 172.26.145.32
• grolem with the ip address 172.26.145.33

Moreover, grolem runs a directory server too.

The problem is, I have unexpected and yet unexplained opened socket on my VM's.

The nodes seem to communicate with each other, as shown by the following screenshot:

Why 172.26.145.31 communicate with 172.26.145.32 ? I don't have any client requesting the building of a circuit, and yet two nodes communicate with each other.

Here you can see another screenshot of a tcpdump on goupix ( 172.26.145.31 ) communicating with grodoudou ( 172.26.145.32 ) :

The length seems to be the size of Tor cells if you remove the headers.

Also, why there is a UDP socket "listening" on my machines, doesn't Tor communicate only via TCP? I didn't find any information on this.

Answer 1

Also, why there is a UDP socket "listening" on my machines

I think it's DNS (you can add DNSPort 5353 option in torrc and you will see).

The problem is, i have unexpected and yet unexplained opened socket on my VM's.

Look at your torrc for the following option "ORPort". It's external port for incoming tor connections. (in your torrc it uses 5000 port if you copy and paste torrc from guide, ofc).

Tor manual:

Advertise this port to listen for connections from Tor clients and servers. This option is required to be a Tor server. Set it to "auto" to have Tor pick a port for you. Set it to 0 to not run an ORPort at all. This option can occur more than once. (Default: 0)