How to check tor exit node IP address?

General
1

Hello I am trying to get the IP address of my tor exit nodes. What I did is:

> curl --socks5-hostname  localhost:9150 -u <my_token>: ipinfo.io
curl: (97) Can't complete SOCKS5 connection to ipinfo.io. (6)

How should I do this ? As far as I know the exit node IP address can only become known specifying the --socks5-hostname host proxy option.

Thank you.

1 Like
2

Hey CKB,

Thank you for posting in the community. Really appreciate it.

curl --socks5-hostname localhost:9150 -u <my_token>: ipinfo.io
curl: (97) Can’t complete SOCKS5 connection to ipinfo.io. (6)

Your code looks okay to me. But I believe sometimes TOR socks5 port can be on 9050.

Can you kindly verify if your socks5 connection is on 9150, please?

:link: what differs between 9050 and 9150? – Reddit

My socks5 connection port is on 9150

$ curl --socks5-hostname localhost:9150 -u $token: ipinfo.io

{
  "ip": "185.220.101.XXX",
  "hostname": "tor-exit-184.relayon.org",
  "city": "Berlin",
  "region": "Berlin",
  "country": "DE",
  "loc": "52.5244,13.4105",
  "org": "AS60729 Zwiebelfreunde e.V.",
  "postal": "10119",
  "timezone": "Europe/Berlin"
}

However when I enter the incorrect port value I get a similar error to yours:

$ curl --socks5-hostname localhost:9050 -u $token: ipinfo.io
curl: (7) Failed to connect to localhost port 9050 after 2250 ms: Couldn't connect to server

Let me know if this works for you. Cheers!

1 Like
3

@Abdullah thanks for you reply and suggestions.

My /etc/tor/torrc is well configured with port 9150 as SOCKS v5 proxy port. No confusion here.
In any case the error you show on your test exemplifying output for a wrong proxy port number:

curl: (7) Failed to connect to localhost port 9050 after 2250 ms: Couldn't connect to server

is different from MY reported error:

curl: (97) Can’t complete SOCKS5 connection to [ipinfo.io](http://ipinfo.io). (6)

I think the code is not faulty. In addition the problem is intermittent and seems to point to the ipinfo.io server not … serving (?!?)

At one point I mayget:

> jq -r '.' < <(/usr/bin/curl -s --socks5-hostname localhost:9150 -u <my_token>: ipinfo.io/json)
{ 
 "ip": "94.230.208.xxx", 
 "hostname": "tor3e1.digitale-gesellschaft.ch",
 "city": "Uster",
 "region": "Zurich",
 "country": "CH",
 "loc": "47.3471,8.7209",
 "org": "AS29691 Nine Internet Solutions AG",
 "postal": "8610",
 "timezone": "Europe/Zurich"                                                         
}

which is the correct response. Then at a later time, I may get:

> jq -r '.' < <(/usr/bin/curl -s --socks5-hostname localhost:9150 -u <my_token>: ipinfo.io/json)
parse error: Invalid numeric literal at line 3, column 0

So looking into the curl output I see that my query is denied.

> curl -s --socks5-hostname localhost:9150 -u <my_token>: ipinfo.io/json                            <html><head>
<meta http-equiv="content-type" content="text/html;charset=utf-8">
<title>403 Forbidden</title>
</head>
<body text=#000000 bgcolor=#ffffff>
<h1>Error: Forbidden</h1>
<h2>Your client does not have permission to get URL <code>/</code> from this server.</h2>                              <h2></h2>
</body></html>

I don’t know whether it’s ipinfo.io that denies my query with “Your client does not have permission to get URL from this server.” or it’s the queried Tor node defending against the practice of Tor node mapping by some Internet actors.

Any further suggestion to troubleshoot this, anyone ?

4

Ahhh. Yes, you are right. I looked into it and found that some TOR IP addresses get access denied.

image
image1920Ă—1040 20.8 KB

This is probably due to some security measures we have implemented to stop abuse.

If you are looking to get your public IP information, you can use some of our sister sites:

5

Thank you @Abdullah. This is a confirmation of what I thought could be the root cause of the high failure rate i see in my (very informal) testing.

I will now look at the APIs of the sites you suggests to see if they fit my bill.
Cheers.

1 Like
6

And for the sake of information, I confirm that other services do not have restrictive policies as to the nature of queried nodes. One is https://checkip.dyndns.org. It will return an HTML formated string containing the exit IP of any tor exit relay, issuing:

$ /usr/bin/curl -s --socks5-hostname localhost:<my_socks_port> checkip.dyndns.org

You then need to clean up that output with a stream editor, e.g. sed or awk, to get a clean IP.

Cheers all.

1 Like