[tor-dev] Detecting multi-homed exit relays (was: Onion auto-redirects using Alt-Svc HTTP header)

[Philipp Winter]

On Wed, Nov 15, 2017 at 10:03:39AM -0600, Tom Ritter wrote:
> Detecting exit nodes is error prone, as you point out. Some exit nodes
> have their traffic exit a different address than their listening
> port.[1]

Right.  It's not trivial for tor to figure out what exit relays are
multi-homed -- at least not without actually establishing circuits and
fetching content over each exit relay.

I just finished an exitmap scan and found 17 exit relays that exit from
an IP address that is different from what's listed in the consensus:

193.171.202.146 -> 193.171.202.150 for <https://atlas.torproject.org/#details/01A9258A46E97FF8B2CAC7910577862C14F2C524>
104.223.123.99  -> 104.223.123.98 for <https://atlas.torproject.org/#details/D4010FAD096CFB59278015F711776D8CCB2735EC>
87.118.83.3     -> 87.118.82.3 for <https://atlas.torproject.org/#details/A8EA2EBB29B0BA4472F26A04A342967FF06CC104>
89.31.57.58     -> 89.31.57.5 for <https://atlas.torproject.org/#details/7DD29A65C370B86B5BE706EA3B1417745714C8AF>
37.187.105.104  -> 196.54.55.14 for <https://atlas.torproject.org/#details/91824956DFA430C071BF6B94B623DF10931D1D40>
77.247.181.164  -> 77.247.181.162 for <https://atlas.torproject.org/#details/204DFD2A2C6A0DC1FA0EACB495218E0B661704FD>
198.211.103.26  -> 185.165.169.23 for <https://atlas.torproject.org/#details/E56E6976ED9C6B72528ECEDA6C6CEEAC767FA26C>
52.15.62.13     -> 69.181.127.85 for <https://atlas.torproject.org/#details/833B03789A2A98C6B53D792156FEA3D2E1ECE967>
138.197.4.77    -> 163.172.45.46 for <https://atlas.torproject.org/#details/D5D6DBED4BEB90DB089AC1E57EA3A13B9B8AA769>
52.15.62.13     -> 104.132.0.104 for <https://atlas.torproject.org/#details/BF0E33F3897A2109D03DAA2F73AAF8ED25FB6F4D>
31.185.27.203   -> 31.185.27.201 for <https://atlas.torproject.org/#details/5D263037FC175596B3A344132B0B755EB8FB1D1C>
104.223.123.101 -> 104.223.123.98 for <https://atlas.torproject.org/#details/02A627FA195809A3ABE031B7864CCA7A310F1D44>
77.247.181.166  -> 77.247.181.162 for <https://atlas.torproject.org/#details/77131D7E2EC1CA9B8D737502256DA9103599CE51>
149.56.223.240  -> 149.56.223.241 for <https://atlas.torproject.org/#details/B6718125C43ECA2E5011B3C681BB6638617A9686>
88.190.118.95   -> 94.23.201.80 for <https://atlas.torproject.org/#details/8C8F0AA30AD7819F16BBD530586CFE58EBA39948>
192.241.79.175  -> 192.241.79.178 for <https://atlas.torproject.org/#details/DA6CB6C05F4A404184FC3A85FDB83F935C6620DC>
143.106.60.70   -> 193.15.16.4 for <https://atlas.torproject.org/#details/6BF913C31A47E020637121014DB2AFE0877BD31B>