0

When I launch Firefox, before interacting with the browser, I normally see a couple of outbound connections.

$ sudo netstat --tcp --all --numeric --program | grep ESTABLISHED

tcp        0      0 10.50.0.11:59038        143.204.201.8:443       ESTABLISHED 9963/firefox        
tcp        0      0 10.50.0.11:59040        143.204.201.8:443       ESTABLISHED 9963/firefox 

Nothing exciting there.

Yet, when I launch Tor, before interacting with the browser I see outbound connections and what would appear to be inbound connections.

$ sudo netstat --tcp --all --numeric --program | grep ESTABLISHED

tcp        0      0 127.0.0.1:54238         127.0.0.1:9151          ESTABLISHED 17114/./firefox.rea 
tcp        0      0 127.0.0.1:9151          127.0.0.1:54238         ESTABLISHED 17153/tor           
tcp        0      0 127.0.0.1:9151          127.0.0.1:54240         ESTABLISHED 17153/tor           
tcp        0      0 127.0.0.1:54240         127.0.0.1:9151          ESTABLISHED 17114/./firefox.rea 
tcp        0      0 10.50.0.11:33398        A.B.C:D:9001     ESTABLISHED 17153/tor           
tcp        0      0 127.0.0.1:9151          127.0.0.1:54234         ESTABLISHED 17153/tor           
tcp        0      0 127.0.0.1:54234         127.0.0.1:9151          ESTABLISHED 17114/./firefox.rea 

I'm trying to understand what I'm seeing here and have two questions:

  • Am I correct in thinking that the connection on port 9001 is to the first relay in the circuit? (the IP resolves to D-C-B-A.rev.cloud.scaleway.com)
  • Why there are inbound connections to 127.0.0.1?

Grateful for any help.

0

If you look at the port number for those localhost connections, you'll see that they use port 9151. This is the control port that the Tor Browser configures the tor client to use. Tor's control port allows other programs to control how the tor process operates. The Tor Browser will connect to tor's control port in order to have better control over stream isolation and other things.

So in summary, these connections are expected and are how the Tor Browser communicates with the tor client.

Also you're correct that 163.172.152.22 is the IP address of the first relay in a circuit, specifically your guard relay. You generally shouldn't give this address out to other people since all of your circuits will use this same guard relay.

3

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.