4

I'm looking at the exit lists published at https://collector.torproject.org/archive/exit-lists/, and I'm trying to understand what is the time interval for which I can deduce a certain IP address was an exit node.
Take for example this entry, from 2014-11-01:

ExitNode 0017413E0BD04C427F79B51360031EC95043C012
Published 2014-10-31 14:37:10
LastStatus 2014-10-31 22:57:21
ExitAddress 105.237.225.30 2014-10-31 16:03:55

I understand that the address 105.237.225.30 was verified as an exit node at the instant 2014-10-31 16:03:55, and is guaranteed to have been an exit node at that instant (is that correct?). What is the time interval around that instant for which I can deduce that address was an exit node?

  • From the Published time to the LastStatus time (around 8 hours)?
  • From the Published time to the instant the address was verified (around an hour and a half)?
  • Or maybe I have no guarantee that the address was an exit node except for the instant it was verified?

Even in case I can get no guarantees, I'd be happy to know if I can at least get a time interval for which the address was probably an exit node.

2

I understand that the address 105.237.225.30 was verified as an exit node at the instant 2014-10-31 16:03:55, and is guaranteed to have been an exit node at that instant (is that correct?).

Yes, at that instant a test was performed and the node was an exit.

Or maybe I have no guarantee that the address was an exit node except for the instant it was verified?

In general, the node is guaranteed to have been an exit at the instant of being found in a test. Now, why is this? A couple of details per the spec jump out.

Published

  • A node publishes as soon as it passes it's self test
  • Can also be read as meaning last published
  • A descriptor is published when changed or 18hrs passed
  • Doesn't consider if the node went down, for example the vm paused/network interruptions
  • Uptime must reset (to trigger a re-publish) by restart

LastStatus

So in the interval [Published, LastStatus] having Published < LastStatus this means

  • the self test was passed, consensus was taken, and an exit-policy was published with the descriptor
  • the authority managed to connect to this node in the last 45 minutes from LastStatus

Be careful where Published > LastStatus such as this case

Published 2014-12-22 22:00:29 LastStatus 2014-12-22 20:03:07 ExitAddress xx.xx.xxx.xx 2014-12-22 22:14:11

The node may have given up the Exit flag, or may have gotten BadExit. Tor has many transient qualities so things like this happen. The node was tested after re-publishing it's descriptor but didn't get consensus (but was still in the cache of TorDNSEL).

A similar argument applies in the interval [Published, Test] except you know the node was an exit at the time of the test. Consider another example from the CollecTor page.

Published 2010-12-28 07:35:55 LastStatus 2010-12-28 08:10:11 ExitAddress 91.102.152.236 2010-12-28 07:10:30 ExitAddress 91.102.152.227 2010-12-28 10:35:30

This node last updated it's descriptor at 07:35:55. It did this after the test at 7:10:30. The last consensus was at 08:10:11 and the last test was at 10:35:30. What conclusions can be drawn about both exit ip's? The first ip was internal to tor and was also the exit. The second was found to be an exit. Maybe they've only got one ip address and it changed. Maybe they run a multi-homed node. The point is what we know (and can guarantee) is limited compared to what we can try to guess (and may be right but certainly not in general).

Even in case I can get no guarantees, I'd be happy to know if I can at least get a time interval for which the address was probably an exit node.

So then what's the answer? It's this -- hope for the best. A node that isn't in the consensus can (but probably shouldn't) still be tested. For an arbitrary entry any time after the LastStatus (minus a max of 45 minutes) until you take the consensus as expired is such an interval. Depending on how you consider expired consensus that means 1 - 3 hours (up to fresh-until, or, not past valid-until).

tl;dr, for a given LastStatus, 1 - 3 hours depending on your preferred view of expired consensus. This is based on hoping for the best possible scenario in general. It would be best to consider the history of an exit across as many sample points as possible.

-- leeroy

  • Your links seem to go to unrelated places. Do you think you can fix them? – gsingh2011 Sep 2 '16 at 21:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.