On linux with wireshark I saw a lot of dns activity including a request for a site I am pretty sure I visited with Tor browser bundle earlier a few days ago. Not visited with regular firefox. However dns request made without Tor browser bundle running. Coincidence ? My mistake seeing things not there ?
After looking into the strange (lot of) dns activity it seemed to me it was caused by nscd. After removing nscd from the system, traffic went relatively quit as far as dns. Also I set both
network.dnsCacheExpiration and network.dnsCacheExpirationGracePeriod
to zero to kill any cache dns activity.
Could it be that nscd can leak what sites are visited with Tor browser bundle? Maybe illogical, but just to make sure.