On Sun, Feb 15, 2009 at 08:12:44AM -0500, forc...@safe-mail.net wrote: > I have in my torrc file this line: > > ExcludeNodes {de},xxx,yyy > > Despite the German nodes should not be used, some circuits use some of them, > right now for example > > LavendarMan (Online) > Location: Worms, DE > IP Address: 89.12.25.230 > > and > > susebib (Online) > Location: DE > IP Address: 90.135.0.47 > > The first one is in Germany according to a whois, the second one in fact > seems to be in Sweden. > > So if the second could be used, why is the first used?
1) Whois is not a good way to find out where a computer actually is. Whois tells you about where the DNS name is registered, not where the computer is physically located. GeoIP is a better bet. (FWIW, both of those addresses seem to be in Germany according to GeoIP too. But I just wanted to mention that whois is a poor choice here.) 2) What version of Tor are you running? You didn't say. 3) Tor needs a geoip file to have country detection work. Yours was installed, right? 4) For some features, like hidden services, Tor needs to use particular nodes, since those were chosen by the service provider as introduction points, or they wound up as HS directories. Do you know if you were you contacting or publishing a hidden service at the time? 5) Do you know what position in your circuit these nodes occupied? 6) Did you get an INFO log by any chance? (Please don't post it to the list if it's huge.) hope this helps, -- Nick