I seem to be observing some odd behaviour whilst experimenting with TOR. It's entirely possible this is just my own ignorance as well, in which case I would appreciate some clarification/enlightenment!
I have two computers running at the moment (both behind my router), lets call them SENDER and RECEIVER. I have port forwarding on my router turned on for port 22222 to the RECEIVER computer.
On the RECEIVER computer, I'm running wireshark (to see things as they happen and check IPs). On the RECEIVER I also have
netcat running like this:
nc -l 22222 > testfile.txt.
On the SENDER computer, I'm running tor. When in the tor browser it says I'm using TOR, and when I go to
check.torproject.org it tells me it appears my IP address is (lets say)
IP_ADDRESS_1. Then, on the sender computer, I'm using the following commands to send packets to my routers internet facing IP at port 22222 (so that it is forwarded on to RECEIVER) through TOR.
socat TCP4-LISTEN:3000,fork SOCKS4a:127.0.0.1:INTERNET_FACING_IP_OF_ROUTER:22222,socksport=9050
The above sends all traffic sent to
127.0.0.1:3000 through TOR to the address
I then do the following to send packets to the RECEIVER computer:
nc 127.0.0.1 3000 < testsend.txt
Now, when I see the packets come into the RECEIVER (by viewing wireshark capturing TCP on port 22222), I'm noticing that the IP the data is coming from is different from the IP that I see when going to
check.torproject.org on the SENDER machine. Thinking this was strange, I looked up the IP the packets were coming from, and sure enough, it was that of another TOR exit node. I'm also not entirely sure of a pattern with respect to "using a new TOR circuit" in all of this.
Is anyone able to tell me what's going on here? My expectation was that I would see the same IP as the source for incoming packets from my computer behind TOR as I would while checking
check.torproject.org on the SENDER machine.