{"id":6172,"date":"2026-09-05T09:59:08","date_gmt":"2026-09-05T00:59:08","guid":{"rendered":"https:\/\/eternalsphere.net\/echoes\/?p=6172"},"modified":"2026-09-12T17:17:50","modified_gmt":"2026-09-12T08:17:50","slug":"gwa93bfd7mrdmrs","status":"publish","type":"post","link":"https:\/\/blog.eternalsphere.net\/index.php\/2026\/09\/05\/gwa93bfd7mrdmrs\/","title":{"rendered":"How Tor Relays Connect to Each Other: OR Connections, Peers, and Connection Pools"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A Tor relay can maintain hundreds or even thousands of simultaneous network connections. This often raises a natural question: does every relay connect to every other relay in the Tor network?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The answer is no.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tor does not operate as a full mesh. Instead, relays dynamically establish and reuse encrypted Onion Routing connections according to network activity.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. TCP Connections and OR Connections Are Different Concepts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">At the operating-system level, a relay communicates through ordinary TCP sockets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tor then runs its own encrypted relay protocol over those TCP connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Conceptually:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>TCP connection\n     \u2193\nTLS\n     \u2193\nTor OR protocol\n     \u2193\nTor circuits<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An established TCP connection between two Tor relays can therefore become an <strong>OR connection<\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. What an OR Connection Does<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">OR means Onion Routing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An OR connection is an authenticated encrypted channel between Tor nodes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One important property is that a single OR connection can carry many Tor circuits simultaneously.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is not:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>one user\n=\none TCP connection<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Instead:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Relay A\n   \u2502\n   \u2502 one reusable OR connection\n   \u25bc\nRelay B\n   \u251c\u2500\u2500 Circuit 1\n   \u251c\u2500\u2500 Circuit 2\n   \u251c\u2500\u2500 Circuit 3\n   \u2514\u2500\u2500 many more<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Connection reuse greatly reduces handshake overhead and makes the network more efficient.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Inbound and Outbound Connections<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A public relay participates in both directions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An inbound connection occurs when another Tor node connects to the relay&#8217;s published ORPort:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Remote Relay\n     \u2193\nPublic ORPort\n     \u2193\nLocal Relay<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">An outbound connection occurs when the local relay initiates a connection to another Tor node:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Local Relay\n     \u2193\nRemote ORPort\n     \u2193\nRemote Relay<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, counting only inbound connections does not reveal the relay&#8217;s entire Tor connection pool.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Why Simple Port Counting Can Be Misleading<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A command that merely searches every TCP connection containing a particular port number can mix several categories together.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A more useful diagnostic separates:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>inbound connections to local ORPort\nunique inbound remote addresses\nall TCP connections owned by Tor\nOR connections reported by Tor itself<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The Tor control interface is especially useful because it can report actual OR connection identities rather than forcing an administrator to infer Tor relationships from TCP sockets alone.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">5. Relay Identity Is More Important Than IP Address<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A Tor peer is fundamentally identified by its cryptographic relay identity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A connection status may conceptually resemble:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ABCD...1234~ExampleRelay CONNECTED<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The long fingerprint is the important part.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nicknames are merely human-readable labels and do not have to be unique.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Similarly, one physical server can run multiple independently identified Tor relay instances.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>800 Tor identities<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">does not necessarily mean:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>800 physical machines<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">although they often roughly correspond.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. Why a New Relay Can Reach Hundreds of Connections Quickly<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">New relays frequently build their connection pools rapidly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reasons include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>directory communication<\/li>\n\n\n\n<li>relay protocol activity<\/li>\n\n\n\n<li>circuit construction<\/li>\n\n\n\n<li>bandwidth measurement<\/li>\n\n\n\n<li>connection reuse<\/li>\n\n\n\n<li>other relays discovering the new node<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Many of these connections are mostly idle.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is therefore entirely possible to see:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1,000 OR connections<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">while actual bandwidth consumption remains below:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>1 Mbit\/s<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Connection count and throughput are fundamentally different metrics.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">7. Tor Is Not a Full Mesh<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Suppose the Tor network contains approximately ten thousand relays.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A full mesh would require every relay to maintain connections to nearly every other relay:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Relay A \u2500 Relay B\n   \u2502   \u2572   \u2502\n   \u2502    \u2572  \u2502\nRelay C \u2500 Relay D<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">At global scale, this would create an unnecessary number of connections.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Tor instead maintains connections according to actual routing and circuit requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consequently, a relay may maintain:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>hundreds<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">or:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>low thousands<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">of OR connections without ever approaching the total number of relays in the network.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">8. Connection Counts Naturally Rise and Fall<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A relay connection pool is dynamic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A healthy history might resemble:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>650\n980\n1,070\n990\n1,120\n1,040<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This is more realistic than:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>650\n1,000\n2,000\n4,000\n8,000<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Connections become idle, expire, fail, or are replaced. New connections appear as new circuits and routing requirements emerge.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A declining connection count therefore does not automatically indicate a problem.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. File Descriptors Provide a Useful Cross-Check<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every TCP socket normally consumes a file descriptor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This means a relay might show a pattern such as:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>OR connections: 1,040\nOpen FDs:        1,055<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If the two values rise and fall together, that is usually a strong indication that the file-descriptor growth is simply normal socket activity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By contrast, steadily increasing file-descriptor usage while connection counts remain constant could warrant further investigation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Unique Peer IPs Are Useful but Imperfect<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Counting unique remote IP addresses helps answer:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">How many different network addresses are currently connected?<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">But IP count still does not equal relay count.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reasons include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>multiple relays can share an IP<\/li>\n\n\n\n<li>one relay identity can move between IP addresses<\/li>\n\n\n\n<li>IPv4 and IPv6 may both be used<\/li>\n\n\n\n<li>NAT and hosting architectures vary<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Tor identity fingerprints remain the authoritative identifier.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The most accurate model of Tor relay connectivity is:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>many reusable encrypted OR connections\n      \u2193\ndynamically created and removed\n      \u2193\neach carrying multiple circuits<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">A relay with approximately one thousand connections is not connected to the entire Tor network, nor is it serving one thousand users. It is simply maintaining a dynamic pool of reusable encrypted channels to other Tor nodes.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A Tor relay can maintain hundreds or even thousands of simultaneous network connections. This often raises a natural question: does every relay connect to every other relay in the Tor network? The answer is no. Tor does not operate as a full mesh. Instead, relays dynamically establish and reuse encrypted &hellip;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[120],"tags":[245],"class_list":["post-6172","post","type-post","status-publish","format-standard","hentry","category-1s3b6h7r2zay02x","tag-tor"],"_links":{"self":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6172","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/comments?post=6172"}],"version-history":[{"count":1,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6172\/revisions"}],"predecessor-version":[{"id":6173,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/posts\/6172\/revisions\/6173"}],"wp:attachment":[{"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/media?parent=6172"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/categories?post=6172"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.eternalsphere.net\/index.php\/wp-json\/wp\/v2\/tags?post=6172"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}