The original post: /r/tor by /u/Affectionate_Cup3684 on 2024-11-11 11:09:59.

Like a few other people last week I got notified by my host that my tor relay was port scanning external hosts. I spent a lot of time looking for the problem, but found nothing. I was ready to put it down to a spoofing attack, but I’ve been monitoring outbound connections on the server and the tor process still seems to be attempting to make outbound connections on port 22.

I’m using ptcpdump to monitor connections with destination port 22, which there should be none, and I’m getting hits every few hours from the tor process to random external IPs on port 22.

config looks like this:

SocksPort 0
ExitRelay 0
DisableDebuggerAttachment 0
RunAsDaemon 1
ORPort 9001
Nickname <removed>
ContactInfo <removed>
DirPort 9030 
ExitPolicy reject *:*

ptcpdump output looks like this:

14:44:21.699029 eth0 tor.812 Out IP <my ip>.47890 > <destination ip>.22: Flags [S], seq 3926882401, win 64240, options [mss 1460,sackOK,TS val 2125664377 ecr 0,nop,wscale 7], length 0, ParentProc [systemd.1]

Can anyone explain this behaviour, or is anyone seeing similar? I’ve firewalled it so it’s not getting out but I’d rather it wasn’t happening at all, since as far as I can see it shouldn’t be.