What's an "onion circuit"?

Question

Being new to tor, I had opened a "onion circuits" window just to see some of it's magic without fully understanding what it means.

I noticed that in the "normal case" I see a variety of hosts from different domains, also changing frequently.

However on one day, all the nodes I saw (over a long time) just came from one domain only, and the list looked quite static. So I wondered whether tor would be as safe as usual or whether someone managed to infiltrate the tor network. Maybe it was just mis-configuration of some tor nodes, I don't know.

So can someone explain the magic about onion circuits and how things should look like if everything looks "normal"?

Examples for "all onion circuits from one source" (as I see it):

Shortly after starting:

After significant usage time:

So what I see is that all Onion Circuits seems to be provided by torpidsUSwholesale. (At another time it was a different name, while still at another time it was many different names)

Answer 1

An onion circuit is a combination of:

(If going to Clearweb) Guard (entry node) -> Relays/Bridges -> Exit node -> Clearweb

(If remaining inside TOR network) Guard (entry node) -> Relays/Bridges -> Hidden Service

A 'circuit' is essentially the path you are taking (like a traceroute) put together by the onion router for you to use. There are settings that can be changed to have this path reconstructed more or less frequently.

Could you provide examples of what you mean when you say 'all the nodes you see come from one domain'. If you want to reconstruct your circuit more often, see the following configuration options:

NewCircuitPeriod NUM

    Every NUM seconds consider whether to build a new circuit. (Default: 30 seconds)

MaxCircuitDirtiness NUM

    Feel free to reuse a circuit that was first used at most NUM seconds ago, but 
    never attach a new stream to a circuit that is too old. For hidden services, 
    this applies to the last time a circuit was used, not the first. Circuits with 
    streams constructed with SOCKS authentication via SocksPorts that have 
    KeepAliveIsolateSOCKSAuth also remain alive for MaxCircuitDirtiness seconds 
    after carrying the last such stream. (Default: 10 minutes)