10Şub
Traffic to Tor node NTP port [closed]
I noticed some strange behaviour on my firewall WAN interface last night, and then later on my LAN interface as well.
There seems to be traffic to a known tor node 192.99.168.180 on port 123. I block all tor by default on my network, and I haven't seen this address before.
At first I saw it exiting the WAN side of my network, and now I see it originating from LAN as well. My time servers are the OS and firewall default, and this has never happened before.
I did a fresh format of my machine and router, and I'm still seeing the traffic, leading me to believe that there is a tor node in the NTP pool of servers. Any way I can verify this? How can i get ip of all time servers in the pool of servers.
