GitLab

Many people use Tor to proxify their non-Tor software such as Bitcoin, BitMessage. And some of them are using SOCKS4.

torrc: DNSPort X SocksPort Y

1. User's software query DNS via DNSPort: www.example.com
2. Tor will create a path to www.example.com:0 to resolve its IP
3. Tor return www.example.com is 1.2.3.4
4. User's software connect to www.example.com via SocksPort, using Socks4.

Expected: In step 4, Tor will use step 2's path to connect www.example.com because Tor know www.example.com may be 1.2.3.4.

Actual: In step 4, Tor create a new path to connect to www.example.com, thus www.example.com's server admin will see 2 incoming connection;

1. DNS request from (step2's exit ip)
2. WWW request from (step4's exit ip)