How Tor Relays Connect to Each Other: OR Connections, Peers, and Connection Pools

A Tor relay can maintain hundreds or even thousands of simultaneous network connections. This often raises a natural question: does every relay connect to every other relay in the Tor network?

The answer is no.

Tor does not operate as a full mesh. Instead, relays dynamically establish and reuse encrypted Onion Routing connections according to network activity.

1. TCP Connections and OR Connections Are Different Concepts

At the operating-system level, a relay communicates through ordinary TCP sockets.

Tor then runs its own encrypted relay protocol over those TCP connections.

Conceptually:

TCP connection
     ↓
TLS
     ↓
Tor OR protocol
     ↓
Tor circuits

An established TCP connection between two Tor relays can therefore become an OR connection.

2. What an OR Connection Does

OR means Onion Routing.

An OR connection is an authenticated encrypted channel between Tor nodes.

One important property is that a single OR connection can carry many Tor circuits simultaneously.

It is not:

one user
=
one TCP connection

Instead:

Relay A
   │
   │ one reusable OR connection
   ▼
Relay B
   ├── Circuit 1
   ├── Circuit 2
   ├── Circuit 3
   └── many more

Connection reuse greatly reduces handshake overhead and makes the network more efficient.

3. Inbound and Outbound Connections

A public relay participates in both directions.

An inbound connection occurs when another Tor node connects to the relay’s published ORPort:

Remote Relay
     ↓
Public ORPort
     ↓
Local Relay

An outbound connection occurs when the local relay initiates a connection to another Tor node:

Local Relay
     ↓
Remote ORPort
     ↓
Remote Relay

Therefore, counting only inbound connections does not reveal the relay’s entire Tor connection pool.

4. Why Simple Port Counting Can Be Misleading

A command that merely searches every TCP connection containing a particular port number can mix several categories together.

A more useful diagnostic separates:

inbound connections to local ORPort
unique inbound remote addresses
all TCP connections owned by Tor
OR connections reported by Tor itself

The Tor control interface is especially useful because it can report actual OR connection identities rather than forcing an administrator to infer Tor relationships from TCP sockets alone.

5. Relay Identity Is More Important Than IP Address

A Tor peer is fundamentally identified by its cryptographic relay identity.

A connection status may conceptually resemble:

$ABCD...1234~ExampleRelay CONNECTED

The long fingerprint is the important part.

Nicknames are merely human-readable labels and do not have to be unique.

Similarly, one physical server can run multiple independently identified Tor relay instances.

Therefore:

800 Tor identities

does not necessarily mean:

800 physical machines

although they often roughly correspond.

6. Why a New Relay Can Reach Hundreds of Connections Quickly

New relays frequently build their connection pools rapidly.

Reasons include:

• directory communication
• relay protocol activity
• circuit construction
• bandwidth measurement
• connection reuse
• other relays discovering the new node

Many of these connections are mostly idle.

It is therefore entirely possible to see:

1,000 OR connections

while actual bandwidth consumption remains below:

1 Mbit/s

Connection count and throughput are fundamentally different metrics.

7. Tor Is Not a Full Mesh

Suppose the Tor network contains approximately ten thousand relays.

A full mesh would require every relay to maintain connections to nearly every other relay:

Relay A ─ Relay B
   │   ╲   │
   │    ╲  │
Relay C ─ Relay D

At global scale, this would create an unnecessary number of connections.

Tor instead maintains connections according to actual routing and circuit requirements.

Consequently, a relay may maintain:

hundreds

or:

low thousands

of OR connections without ever approaching the total number of relays in the network.

8. Connection Counts Naturally Rise and Fall

A relay connection pool is dynamic.

A healthy history might resemble:

650
980
1,070
990
1,120
1,040

This is more realistic than:

650
1,000
2,000
4,000
8,000

Connections become idle, expire, fail, or are replaced. New connections appear as new circuits and routing requirements emerge.

A declining connection count therefore does not automatically indicate a problem.

9. File Descriptors Provide a Useful Cross-Check

Every TCP socket normally consumes a file descriptor.

This means a relay might show a pattern such as:

OR connections: 1,040
Open FDs:        1,055

If the two values rise and fall together, that is usually a strong indication that the file-descriptor growth is simply normal socket activity.

By contrast, steadily increasing file-descriptor usage while connection counts remain constant could warrant further investigation.

10. Unique Peer IPs Are Useful but Imperfect

Counting unique remote IP addresses helps answer:

How many different network addresses are currently connected?

But IP count still does not equal relay count.

Reasons include:

• multiple relays can share an IP
• one relay identity can move between IP addresses
• IPv4 and IPv6 may both be used
• NAT and hosting architectures vary

Tor identity fingerprints remain the authoritative identifier.

Conclusion

The most accurate model of Tor relay connectivity is:

many reusable encrypted OR connections
      ↓
dynamically created and removed
      ↓
each carrying multiple circuits

A relay with approximately one thousand connections is not connected to the entire Tor network, nor is it serving one thousand users. It is simply maintaining a dynamic pool of reusable encrypted channels to other Tor nodes.