I’m running an exit node,
yreka and have noticed as single IP address that has been
connected for at least a day, probably longer, which is
pushing anywhere from 3Mb to 9Mb but receives very little
traffic back from my node, sub 500Kb. My traffic to this
machine is going out of 443 (my ORPort) and being sent to port
50090 on the other machine. I only allow exit traffic to
ports 80 and 443. So I do not think this is exit traffic. I
have also checked on blutmagie and could not find the IP as a
relay which would suggest that this is a TOR user and I am
serving as an entry node. I have never seen such speeds for a
single user.
The one sided
nature of the traffic and its size have my interests peaked.
I just wanted to verify that this is not unusual and something
that I should investigating. I did not include the IP address
of the machine because I was not sure it would be in the
spirit of TOR to post such information. Any feedback would be
greatly appreciated.