There are three different ways to tell Tor to resolve a hostname: 1. Using the SOCKS RESOLVE protocol (e.g. via tor-resolve) 2. Setting DNSPort and using standard DNS requests 3. Sending a RESOLVE request via the control protocol. All three methods lead to different stream events being sent via the control protocol. Method 1 leads to these events: ``` 650 STREAM 95 NEWRESOLVE 0 heise.de:0 PURPOSE=DNS_REQUEST 650 STREAM 95 NEW 15 heise.de:0 SOURCE_ADDR=(Tor_internal):58776 PURPOSE=DNS_REQUEST 650 STREAM 95 SENTRESOLVE 15 heise.de:0 650 STREAM 95 SUCCEEDED 15 heise.de:0 650 STREAM 95 REMAP 15 193.99.144.80:0 SOURCE=EXIT 650 STREAM 95 CLOSED 15 193.99.144.80:0 REASON=DONE ``` Method 2: ``` 650 STREAM 99 NEW 0 heise.de:0 SOURCE_ADDR=127.0.0.1:39482 PURPOSE=DNS_REQUEST 650 STREAM 99 NEW 17 heise.de:0 SOURCE_ADDR=(Tor_internal):39482 PURPOSE=DNS_REQUEST 650 STREAM 99 SENTRESOLVE 17 heise.de:0 650 STREAM 99 REMAP 17 193.99.144.80:0 SOURCE=EXIT 650 STREAM 99 CLOSED 17 193.99.144.80:0 REASON=DONE ``` Method 3: ``` 650 STREAM 103 NEW 18 heise.de:0 SOURCE_ADDR=(Tor_internal):0 PURPOSE=DNS_REQUEST 650 STREAM 103 SENTRESOLVE 18 heise.de:0 650 STREAM 103 REMAP 18 193.99.144.80:0 SOURCE=EXIT 650 STREAM 103 CLOSED 18 193.99.144.80:0 REASON=DONE ``` In my opinion, the following stream events should be generated: ``` 650 STREAM 1 NEWRESOLVE 0 heise.de:0 SOURCE_ADDR=127.0.0.1:12345 PURPOSE=DNS_REQUEST 650 STREAM 1 SENTRESOLVE 1 heise.de:0 650 STREAM 1 REMAP 1 193.99.144.80:0 SOURCE=EXIT 650 STREAM 1 CLOSED 1 193.99.144.80:0 REASON=DONE ``` If the request was generated by method 3, the SOURCE_ADDR should be omitted. The reason why there is a SOURCE_ADDR and a duplicate STREAM_EVENT_NEW is that this was added for ticket legacy/trac#646. I have attached a patch that will lead to the desired output, but I can change it if another output is preferred. **Trac**: **Username**: Desoxy