I'm using wireshark to learn what is going on when I start tor. I expected to see one communication with an authoritative directory node and then a connection with the guard node, but I get something different.

The first package I can see go to a directory but not authoritative node, I thought that tor software only has hard-coded authoritative directory nodes, but I can understand that it has several more in order to avoid overflow.

But then it sends connection packages to 3 more nodes successively and I can see in tor browser that guard is one of this. So, we make contact with a directory node and a guard node but what is the purpose of that connections?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.