Re: Someone manipulating Tor routing?

[Peter Palfrader <peter@xxxxxxxxxxxxx>]

On Fri, 17 Feb 2006, Mike Zanker wrote:

> On 17/02/2006 09:06, Sebastian Wiesinger wrote:
> 
> > 200.222.72.146 is also a real POP3 server.
> 
> Yes - that was the same IP address mine connected to.

That's a Tor server, or at least tries to be.

[..]
Feb 17 15:19:55.308 [info] connection_read_to_buf(): tls error. breaking (nickname $3AE0FCB8B1A8C9AB66B149C15EEED0EEC6EED262, address 200.222.72.146).
Feb 17 15:34:04.813 [info] connection_read_to_buf(): tls error. breaking (nickname $3AE0FCB8B1A8C9AB66B149C15EEED0EEC6EED262, address 200.222.72.146).
Feb 17 15:55:24.164 [info] connection_read_to_buf(): tls error. breaking (nickname $3AE0FCB8B1A8C9AB66B149C15EEED0EEC6EED262, address 200.222.72.146).
Feb 17 16:13:41.558 [info] run_connection_housekeeping(): Marking duplicate conn to 200.222.72.146:1047 obsolete (fd 3068, 926 secs old).
Feb 17 16:13:41.558 [info] run_connection_housekeeping(): Expiring non-used OR connection to fd 3068 (200.222.72.146:1047) [Obsolete].

It's likely that the operator set a ORPort of 110 and it tries to check if it's
reachable.  Which it isn't.  Hopefully the owner will look into their log some
time.

Peter
-- 
 PGP signed and encrypted  |  .''`.  ** Debian GNU/Linux **
    messages preferred.    | : :' :      The  universal
                           | `. `'      Operating System
 http://www.palfrader.org/ |   `-    http://www.debian.org/