No matter what I am trying, I can't change the first server in the circuit. Neither "New Identity" nor "New Circuit" or closing the browser will change it. I tried two different tor instances from different (verified) downloads. While the first server (IP) is different, I can't force it to change there either.

Am I wrong or does this seem to be a bad bad bug? I mean the first server is the instance which knows the clients real IP (thus, in connection with the third, it will be possible do identify the client). Shouldn't this server change frequently too?

Edit: I am using the current (4.5.3) version of the TBB and it is the first time I noticed it. The server itself seems not malicious or ill-intended (the owner seems trustworthy and a private individual who operates a blog).


This is expected, and by design.

See these previous threads asking the same question:

For more information on Entry Guards, and how they work, see the Tor FAQ.

  • Thank you. I was not aware of the terminology (guard node) and did not find the q/a's. I was aware of the attack, but I am still not sure if the solution is that much better. If the guard node is indeed malicious, this becomes a giant problem. Wouldn't the exit node be the only changing node among the two important nodes to observe, and thus half the attack surface (double the probability of a eves-dropping circuit)?
    – Jay
    Jul 12 '15 at 11:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.