Or does it even matter?

I connected to almost a dozen paths and ran the "shields up" port probe at GRC.com

All but three had most ports in stealth mode. (Most had SSH, HTTP, and HTTPS connections either accepted or rejected.) One path had more than a dozen ports open, and two of them had almost all ports open.

I would just as soon not route through a host like that.

1 Answer 1


If your data is encrypted - e.g. if you're using HTTPS, which Tor attempts to do as default - then that data isn't accessible to an attacker. The attacker could either be the owner of the exit node, or someone who has compromised the exit node via an open port. I always assume the worst case: the exit node I'm using is owned by the Bad Guys. In which case, the ports being open doesn't really matter.

Additionally, being selective about which exit node you want to use doesn't necessarily make things safer. If everyone did this, and selected exit nodes with no open ports, then those nodes could become a bottleneck and slow the network. (Though this would depend on how many such nodes there are, and the level of exit node redundancy in the normal case.) If the Bad Guys realised that people were routing through a certain sub-set of nodes, this would then provide them with a new attack vector: set up exit nodes with no open ports.

It's also worth noting that all exit nodes are systematically scanned with Exitmap, which is a tool specifically used to check for misconfigured and malicious exit nodes. (The Spoiled Onions paper has lots more details on how it works.)

  • My SMALL sample suggests around eighty percent have most ports stealthed.
    – WGroleau
    Oct 6, 2015 at 2:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .