1

I seem to be observing some odd behaviour whilst experimenting with Tor. It's entirely possible this is just my own ignorance as well, in which case I would appreciate some clarification/enlightenment!

I have two computers running at the moment (both behind my router), lets call them SENDER and RECEIVER. I have port forwarding on my router turned on for port 22222 to the RECEIVER computer.

On the RECEIVER computer, I'm running wireshark (to see things as they happen and check IPs). On the RECEIVER I also have netcat running like this: nc -l 22222 > testfile.txt.

On the SENDER computer, I'm running tor. When in the Tor browser it says I'm using Tor, and when I go to check.torproject.org it tells me it appears my IP address is (lets say) IP_ADDRESS_1. Then, on the sender computer, I'm using the following commands to send packets to my routers internet facing IP at port 22222 (so that it is forwarded on to RECEIVER) through Tor. 

socat TCP4-LISTEN:3000,fork SOCKS4a:127.0.0.1:INTERNET_FACING_IP_OF_ROUTER:22222,socksport=9050

The above sends all traffic sent to 127.0.0.1:3000 through Tor to the address INTERNET_FACING_IP_OF_ROUTER:22222.

I then do the following to send packets to the RECEIVER computer:

nc 127.0.0.1 3000 < testsend.txt

Now, when I see the packets come into the RECEIVER (by viewing wireshark capturing TCP on port 22222), I'm noticing that the IP the data is coming from is different from the IP that I see when going to check.torproject.org on the SENDER machine. Thinking this was strange, I looked up the IP the packets were coming from, and sure enough, it was that of another Tor exit node. I'm also not entirely sure of a pattern with respect to "using a new Tor circuit" in all of this.

Is anyone able to tell me what's going on here? My expectation was that I would see the same IP as the source for incoming packets from my computer behind Tor as I would while checking check.torproject.org on the SENDER machine.

Improve this question

1 Answer 1

Reset to default
2

It is kind of by design that exit nodes change. If all your traffic exited through the same node, then it would be easier to track you (not knowing who you are in reality, but noticing that it is the same "you").

Improve this answer
4
  • are you able to elaborate on this at all? I'm aware that exit notes change over time (about every 10 minutes or so by default), but I didn't know the exit node changes based on the port or specific connection being made? For instance if I use the TOR browser for 5 minutes, all my HTTP/HTTPS traffic is coming from the same IP during that time-frame.
    – DJSunny
    Mar 10, 2013 at 0:52
  • 1
    Well it would take some delving in the Tor source code, but from your observation, I expect that the random path selection will be done and maintained on a per-port basis, which makes sense programmatically (it would be a natural by-product of some implementation strategies) and can be viewed as a feature (different port = different protocol = possible privacy-killing tracking).
    – Thomas Pornin
    Mar 10, 2013 at 15:35
  • Tor now uses stream isolation, so different processes use different circuits.
    – mirimir
    Dec 14, 2013 at 4:44
  • Not just different circuits, but different browser tabs as well (which is a more recent addition).
    – forest
    Nov 29, 2017 at 7:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .