A while ago my conky started to list several strange connections.


I'm using Linux so I tried something:

sudo lsof -i | egrep -i "poneytelecom|dark"

And got an interesting output: Processes

I cannot remember putting tor into my autostart or something similar. In my task-list tor ran as root but cannot remember granting it root-rights.

Is this behaviour normal?


For experimental purposes I have installed torchat but wasn't satisfied, so I just ignored it, maybe I'll read something one day how to use it properly. Apparently torchat installs several other packages too. One of them was tor itself which launched at autostart and connected to the network.

It's still questionable why it connects to "dark-it.net" but after removing torchat and a follow-up apt-get autoremove all the packages were removed, since then no strange behaviour any more.


What happened was that you installed a Tor package (maybe/probably Debian/Ubuntu's) which is configured to start Tor at boot as a system service by design. It gets launched by root, but drops its permissions after it started so it doesn't really continue to run as root.

The connections to "strange servers" are just the domain names of servers that run Tor relays that your Tor client connected to, nothing to worry about as it is normal when operating an instance of Tor. By uninstalling the Tor package from your system you got rid of these connections because there's no longer a need to connect to Tor relays to keep your Tor client operational.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.