fetchmail logs showing a Tor exit node is compromised

Running nyx just shows some of the circuits (guard, middle, exit) but I seem to have no way of associating those circuits with fetchmail’s traffic. Anyone know how to track which exit node is used for various sessions?

In nyx, on the first page, press e and enable STREAM events. These have the following form:

 text

    
[stream id] [status] [circuit id] [hostname/ip]:[port] ...

Find the correct stream based on hostname/ip, then you can cross-reference the [circuit id] with the items on the Connections page.

2 comments

Running nyx just shows some of the circuits (guard, middle, exit) but I seem to have no way of associating those circuits with fetchmail’s traffic. Anyone know how to track which exit node is used for various sessions?
In nyx, on the first page, press e and enable STREAM events. These have the following form:
text

[stream id] [status] [circuit id] [hostname/ip]:[port] ...
Find the correct stream based on hostname/ip, then you can cross-reference the [circuit id] with the items on the Connections page.
- Thanks for the tip. The info would be gone now but I’ll try that next time it happens.