How Tor Selects Entry Guard Nodes

Tor protects user anonymity by routing internet traffic through a three-node circuit, where the entry guard serves as the crucial first hop. The selection of an entry guard is a two-tier process: Directory Authorities first evaluate and assign the official “Guard” flag to qualifying relays, and the Tor client then chooses and retains a small, persistent set of these relays based on bandwidth, network diversity rules, and reliability metrics.

Directory Authority Flag Assignment

Before a relay can become an entry guard, Tor’s Directory Authorities must evaluate its performance and assign it the Guard flag. The relay must satisfy several strict prerequisites:

• Bandwidth Thresholds: The relay must have a high consensus bandwidth weight. Authorities compare the node’s capacity against the median and general performance distribution across the entire network, ensuring that only high-capacity nodes handle guard duties.
• High Uptime and Reliability: The relay must prove long-term stability. Authorities calculate a metric known as Weighted Fractional Uptime (WFU) to ensure the node does not frequently disconnect or restart.
• Fast Flag Prerequisite: To qualify as a guard, a relay must first meet the criteria for the Fast flag, guaranteeing low latency and sufficient throughput.

Client-Side Guard Selection Process

Once relays receive the Guard flag in the network consensus, individual Tor clients select which specific guards to use:

• Bandwidth-Weighted Probability: The client downloads the consensus document and randomly selects a guard, with the probability weighted by each guard’s advertised bandwidth. Faster relays are chosen more frequently to optimize network performance.
• Network Diversity and Subnet Restrictions: To prevent an adversary from controlling multiple nodes in a single circuit, Tor enforces strict diversity constraints. The client will not choose a guard that shares a family declaration (MyFamily) or belongs to the same /16 IPv4 (or /32 IPv6) subnet as the exit or middle relays in the intended circuit.

Guard Persistence and Rotation

To defend against correlation and profiling attacks, Tor clients do not switch entry guards for every new connection. Instead, the client selects a small set of primary and fallback guards (defined by the Guard algorithm) and keeps them for roughly 120 to 180 days.

By pinning the user’s entry point to a long-lived, stable node, the Tor network significantly limits the probability that an adversary will successfully monitor both the entry and exit points of a user’s connection over time. If the primary guard becomes temporarily unreachable, the client falls back to a secondary guard from its persistent list until the primary returns online.