Running netstat and analyzing my established connections I noticed sometimes tor talks to other IPs that aren't my guard node. I'm not sure if this is supposed to happen because I very very new to this. At first I thought this could be my tor choosing it's relays but not sure if this' how it works. I want to know if this is expected. I searched for info about this IPs. Some of them are labeled as "tor related" or are exit nodes, others are not. I remember most of them being from Germany, which leads me to another question.

Why are there so many German relays? Sometimes all my three relays happen to be from Germany. I heard about end-to-end attacks but don't know if this is the case.

Im not posting the ips. My browser's GPG were verified.

2 Answers 2


Yes this is normal. Tor doesn't have a single guard, but instead maintains a guard set of several guards. You can find these listed in tor's state file. A tor client may also connect to other relays in order to test their eligibility for being added to this guard set.


It's OK for any self-reorganizing network, including the Tor one! The red flag - in means of connection listing - if there will be a connections to the IP addresses you're sure that are not members of Tor network and not a services you do need to use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.