netstat reporting destinion IP address

[Gregory Maxwell]

On 11/24/07, anonym <anonym at lavabit.com> wrote:
[snip]
> Now, with this background information in mind I can go on to my actual
> questions for those of you who have managed to read all this (sorry for
> being so verbose): Why does this happen? Is netstat operating on a too
> high level to detect this kernel level magic?


Netstat is telling the truth: You have a connection opened to foohost.
 It just so happens that there is some machinery under the hood that
intercepts the traffic and redirects it into tor, but this doesn't
change where the connection is actually going as far as the system is
concerned.

Not only is netstat 'operating on a too high level to detect this', it
would be a bug if it reported anything else.


> Even though we still get as much anonymity as Tor offers and netstat is
> wrong in some way I really do not want this to happen. Incognito uses
> TorK as a control GUI to Tor, and since its "Non-Tor traffic log" uses
> netstat and thus will log these erroneous connections, users might freak
> out and think that Incognito is unsafe. In fact, that was what happened
> to me. Can this be fixed?

Yes. Don't do that.

it would be better if you were running something that sniffed the
network and showed the user all outbound packets that were not TOR.

Just looking at netstat may well miss short-lived (and especially
connectionless) packets which are probably much more of a significant
real threat to the user.