When using Tor, I issued this in terminal sudo netstat -punta | grep 443. Output was

tcp        0      0 x.x.x.x:y      a.a.a.a:443        ESTABLISHED 5769/tor        
tcp        0      0 x.x.x.x:y      b.b.b.b:443        ESTABLISHED 5769/tor        
tcp        0      0 x.x.x.x:y      c.c.c.c:443        ESTABLISHED 5769/tor

This output is when I am almost an hour into the session. Why there are 3 encrypted connections ? I thought there is one entry node. Tor connects with at least 3 nodes, but it does serially. So, there should be only one connection at my end.

  • No, it is not, please read the edited question again.
    – rhc
    Jun 16, 2015 at 14:20
  • Hmmm, I see what you're saying now. I retracted my vote.
    – RoraΖ
    Jun 16, 2015 at 14:25
  • When running mine I only see two connections for Tor. I'd guess that it could be an old circuit no longer being used. Or possibly they open up a new one of you have too many sessions running through it. Can you provide stats on the sessions you're doing while you see the 3 connections?
    – RoraΖ
    Jun 16, 2015 at 14:44

1 Answer 1


I'm assuming that you're not running a relay yourself, which would of course explain multiple connections.

According to the Tor FAQ, Tor will reuse a same entry node for TCP connections for a duration of 10 minutes, and will then switch to a new entry point. This avoids profiling all of your Internet traffic via a specific entry point (which could help fingerprinting attacks based on the sites you visit).

Previously open TCP connections will keep using the same entry node until the session expires, so if you browse multiple sites but keep the TCP connection active on the first websites, you could easily end up using three different entry nodes.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .