Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I seem to be observing some odd behaviour whilst experimenting with TOR. It's entirely possible this is just my own ignorance as well, in which case I would appreciate some clarification/enlightenment!

I have two computers running at the moment (both behind my router), lets call them SENDER and RECEIVER. I have port forwarding on my router turned on for port 22222 to the RECEIVER computer.

On the RECEIVER computer, I'm running wireshark (to see things as they happen and check IPs). On the RECEIVER I also have netcat running like this: nc -l 22222 > testfile.txt.

On the SENDER computer, I'm running tor. When in the tor browser it says I'm using TOR, and when I go to it tells me it appears my IP address is (lets say) IP_ADDRESS_1. Then, on the sender computer, I'm using the following commands to send packets to my routers internet facing IP at port 22222 (so that it is forwarded on to RECEIVER) through TOR.

socat TCP4-LISTEN:3000,fork SOCKS4a:,socksport=9050

The above sends all traffic sent to through TOR to the address INTERNET_FACING_IP_OF_ROUTER:22222.

I then do the following to send packets to the RECEIVER computer:

nc 3000 < testsend.txt

Now, when I see the packets come into the RECEIVER (by viewing wireshark capturing TCP on port 22222), I'm noticing that the IP the data is coming from is different from the IP that I see when going to on the SENDER machine. Thinking this was strange, I looked up the IP the packets were coming from, and sure enough, it was that of another TOR exit node. I'm also not entirely sure of a pattern with respect to "using a new TOR circuit" in all of this.

Is anyone able to tell me what's going on here? My expectation was that I would see the same IP as the source for incoming packets from my computer behind TOR as I would while checking on the SENDER machine.

share|improve this question

It is kind of by design that exit nodes change. If all your traffic exited through the same node, then it would be easier to track you (not knowing who you are in reality, but noticing that it is the same "you").

share|improve this answer
are you able to elaborate on this at all? I'm aware that exit notes change over time (about every 10 minutes or so by default), but I didn't know the exit node changes based on the port or specific connection being made? For instance if I use the TOR browser for 5 minutes, all my HTTP/HTTPS traffic is coming from the same IP during that time-frame. – csjohn Mar 10 '13 at 0:52
Well it would take some delving in the Tor source code, but from your observation, I expect that the random path selection will be done and maintained on a per-port basis, which makes sense programmatically (it would be a natural by-product of some implementation strategies) and can be viewed as a feature (different port = different protocol = possible privacy-killing tracking). – Thomas Pornin Mar 10 '13 at 15:35
Tor now uses stream isolation, so different processes use different circuits. – mirimir Dec 14 '13 at 4:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.