I use Tor Browser for Linux, and I recently noticed a weird behavior, which makes me think downloads are not being properly proxied.
I start a download (for example go to an Invidious instance and start downloading a video), I then hit “pause” in the download, and after a few seconds “resume”. When the download first starts, it goes at 50~100 KBs. When I hit resume, the entire download goes at 1~2MBs. It happens in all websites, as if the download itself doesn’t goes through the proxy anymore instead using the full internet speed (yes my internet speed is just that, ahah).
I don’t have any expertise o actually check if the connection was reconnected directly, any help is greatly appreciated.
Thanks.
15 days, 100 views, and not one reply? I confess I was hoping to get some feedback…
Anyway, I did a few tests myself, which again are not very useful as I don’t have the knowledge to inspect connections and what not.
I tried downloading a file from an Onion site, the file was hosted at the onion itself and the download was slow as expected. I hit “pause” and a few seconds later “resume”, which worked and the download continued. This means the proxy can’t be fully bypassed since an onion link couldn’t be downloaded through clearnet connection.
However, in this test the download speed did not get the sudden speed increase as it happens when I download from a clearnet site. In those instances, the download is at first slow but when I hit “pause”+“resume” the speed increases (from 50KB/s to 500KB/s for example).
Then again, onion sites are slower by their own nature of working, so… Can’t really decipher much from there.
Any other suggestion as to how I can test this myself? I don’t mind doing the work myself, just need some help and guidance.
Thank you.
OK, I ran another test, maybe it’s helpful.
I started a download which was going again slow (about 20KB/s or so) and ran in the terminal:
lsof -i
I noticed a lot of firefox.r lines all connected to both 9150 and 9151 ports. tor itself was connected to all sorts of IPs and ports which I assume is natural.
I hit the “pause”+“resume” and the download speed went up to again about 500KB/s and run lsof -i again.
I noticed all the lines were pretty much the same, firefox.r always connects to localhost and then either 9150 or 9151.
Is this a good sign? And what could then explain the speed increase?
TorBrowser (firefox) is indeed only supposed to connect to 9150 (tor SocksPort) and 9151 (tor ControlPort). And tor connects to anything in that list, so “all sorts of IPs and ports” indeed sound natural.
I have no idea what would explain the speed increase. Any explanation I can come up with either wouldn’t last for “the entire download”, or wouldn’t be as reproducible between each tests as you seem to describe
Thanks for the reply @trinity-1686a
Yes, at first I thought the “pause” was not taking effect and that would explain the fast download (it would be merely displaying data that was downloaded before). That would not last for the entire 1 GB file I tried it with.
Also, I noticed that my internet connection goes down when I hit pause, so the pause is taking effect.
Again, I don’t see anything that would say “this is breaking my proxy”, but the speed is too much for my usual Tor connection to account for.
Could anyone try to reproduce the same procedure, and post the results?
Or any tool that could be useful to test it further on my machine (running Ubuntu 20.04 based OS).
I confirm the same behavior still happens in 13.0
Still hoping for help in investigating this issue, if some more experienced user or developer will be so kind. Thank you.
