I installed Tor hidden service, when I use terminal and type netstat -tapln (to see all opened ports) I can see foreign established connection and it is not clear to me is it dangerous or not? Of course, I can see that mysql port is opened and sshd and so on, it is not problem. It is strange for me, I see foreign address (to which server is connected) of companies that have nothing to do with server located in Asia. But all of them use the same process ID (PID) 12973.
One established connection is of course my IP because I use terminal to access server.
Second established connection is french IP.
Third established connection is one web hosting company in Germany.
Forth established connection is one company from the US. Their Global Internet Backbone provides IP Transit.
It is strange that 127.0.0.1:9050 is used by Tor and its PID is 12973/tor, all this companies have the same PID, for example like this: IPAddress:9001 ESTABLISHED 12973/Tor
It means if I kill PID 12973 I will kill Tor, not only these companies. So, why Tor has the same PID like companies from Europe and USA that are connected with server? Server is located in Asia.
Is it some Tor directory authority or descriptor or anything similar? If it is so, can I choose to which Tor descriptor/authority server will connect? Where to find list of them, to choose whom I want?
The most important point: can these companies snitch Tor server? If server traffic goes through them, it would be logical they can snitch traffic.
I suppose if I restart Tor, other companies will be connected with server? or not? I don't want to do it now because my client is changing his website but I can ask here.
