I'm using wireshark to learn what is going on when I start tor. I expected to see one communication with an authoritative directory node and then a connection with the guard node, but I get something different.
The first package I can see go to a directory but not authoritative node, I thought that tor software only has hard-coded authoritative directory nodes, but I can understand that it has several more in order to avoid overflow.
But then it sends connection packages to 3 more nodes successively and I can see in tor browser that guard is one of this. So, we make contact with a directory node and a guard node but what is the purpose of that connections?
