I recently made a private Tor network using virtual machines (with this tutorial). The network is composed of three nodes:
- goupix with the ip address 172.26.145.31
- grodoudou with the ip address 172.26.145.32
- grolem with the ip address 172.26.145.33
Moreover, grolem runs a directory server too.
The problem is, I have unexpected and yet unexplained opened socket on my VM's.
The nodes seem to communicate with each other, as shown by the following screenshot:
Why 172.26.145.31 communicate with 172.26.145.32 ? I don't have any client requesting the building of a circuit, and yet two nodes communicate with each other.
Here you can see another screenshot of a tcpdump on goupix ( 172.26.145.31 ) communicating with grodoudou ( 172.26.145.32 ) :
The length seems to be the size of Tor cells if you remove the headers.
Also, why there is a UDP socket "listening" on my machines, doesn't Tor communicate only via TCP? I didn't find any information on this.