I'm using TOR browser and Wireshark to monitor IP traffic. I noticed that every now and then there are packets flowing from/to other IPs. Checking them, I noticed they are TOR relays, which I think it's strange as they are not my guard node (they are not even in my TOR circuit). What is it about?

1 Answer 1


It's OK - this traffic is used for network integrity and to make a new circuits, so there's no problem at all! Also - you should open not just an ORPort for a way better integration+speeds, but a DirPort to propagate the mirror of Tor network directory services - it will help you collaterally because of increasing speeds and connectivity of the other nodes you will occasionally use

  • DirPort is getting deprecated. gitlab.torproject.org/tpo/core/tor/-/issues/40282 Commented Oct 23, 2021 at 19:52
  • I know, but even nowdays it saves the day sometimes. Also - it should be properly wrapped, not just deprecated - it's a way easier just to rise a directory mirror, encapsulated into the working NGinx, for example, rather than embed the full ORPort functionality
    – Alexey Vesnin
    Commented Oct 25, 2021 at 17:22

You must log in to answer this question.