I understand that the address 220.127.116.11 was verified as an exit node at the instant 2014-10-31 16:03:55, and is guaranteed to have been an exit node at that instant (is that correct?).
Yes, at that instant a test was performed and the node was an exit.
Or maybe I have no guarantee that the address was an exit node except for the instant it was verified?
In general, the node is guaranteed to have been an exit at the instant of being found in a test. Now, why is this? A couple of details per the spec jump out.
- A node publishes as soon as it passes it's self test
- Can also be read as meaning last published
- A descriptor is published when changed or 18hrs passed
- Doesn't consider if the node went down, for example the vm paused/network interruptions
- Uptime must reset (to trigger a re-publish) by restart
So in the interval
[Published, LastStatus] having Published < LastStatus this means
- the self test was passed, consensus was taken, and an exit-policy was published with the descriptor
- the authority managed to connect to this node in the last 45 minutes from LastStatus
Be careful where Published > LastStatus such as this case
Published 2014-12-22 22:00:29
LastStatus 2014-12-22 20:03:07
ExitAddress xx.xx.xxx.xx 2014-12-22 22:14:11
The node may have given up the Exit flag, or may have gotten BadExit. Tor has many transient qualities so things like this happen. The node was tested after re-publishing it's descriptor but didn't get consensus (but was still in the cache of TorDNSEL).
A similar argument applies in the interval
[Published, Test] except you know the node was an exit at the time of the test. Consider another example from the CollecTor page.
Published 2010-12-28 07:35:55
LastStatus 2010-12-28 08:10:11
ExitAddress 18.104.22.168 2010-12-28 07:10:30
ExitAddress 22.214.171.124 2010-12-28 10:35:30
This node last updated it's descriptor at 07:35:55. It did this after the test at 7:10:30. The last consensus was at 08:10:11 and the last test was at 10:35:30. What conclusions can be drawn about both exit ip's? The first ip was internal to tor and was also the exit. The second was found to be an exit. Maybe they've only got one ip address and it changed. Maybe they run a multi-homed node. The point is what we know (and can guarantee) is limited compared to what we can try to guess (and may be right but certainly not in general).
Even in case I can get no guarantees, I'd be happy to know if I can at least get a time interval for which the address was probably an exit node.
So then what's the answer? It's this -- hope for the best. A node that isn't in the consensus can (but probably shouldn't) still be tested. For an arbitrary entry any time after the LastStatus (minus a max of 45 minutes) until you take the consensus as expired is such an interval. Depending on how you consider expired consensus that means 1 - 3 hours (up to fresh-until, or, not past valid-until).
tl;dr, for a given LastStatus, 1 - 3 hours depending on your preferred view of expired consensus. This is based on hoping for the best possible scenario in general. It would be best to consider the history of an exit across as many sample points as possible.