How Tor Selects Middle Relays for Circuits

When building an encrypted three-hop circuit, Tor relies on a consensus-weighted selection algorithm to choose an optimal middle relay. Positioned securely between the entry guard and the exit node, the middle relay processes traffic without knowing the origin IP or the final destination. To preserve user anonymity and maintain network balance, Tor filters all candidate relays against strict diversity constraints—including subnet restrictions, operator family declarations, and bandwidth capacities—ensuring traffic is distributed efficiently and cannot be easily intercepted by a single entity.

The Role of the Middle Relay

A standard Tor circuit consists of three nodes: the guard (entry), the middle (relay), and the exit. The middle relay’s sole purpose is to separate the guard node from the exit node. By isolating these two points, the entry guard knows who the user is but not where they are going, while the exit node knows the destination but not the user’s identity. The middle relay knows only the IP addresses of the guard and the exit.

Bandwidth Weighting via the Consensus

Tor does not choose middle relays at random. Instead, directory authorities continuously measure relay capacities and publish a global consensus document containing “bandwidth weights.”

Clients select relays with a probability proportional to their weighted bandwidth. This mechanism balances network load across thousands of volunteer servers. High-capacity relays process more circuits, while lower-capacity nodes are assigned fewer circuits, preventing performance bottlenecks and improving connection speed.

Node Availability and Flags

Before a relay is considered for the middle position, it must meet basic status requirements defined in the consensus: * Running: The node must currently be online and responding to network checks. * Valid: The node’s identity key and software version must be verified by directory authorities. * Role Reservation: To optimize scarce network resources, nodes designated with the “Guard” or “Exit” flags are prioritized for entry and exit roles, reducing the likelihood of them being used as standard middle relays unless bandwidth distribution requires it.

Path Selection Constraints and Diversity Rules

To prevent adversaries from controlling multiple nodes in the same circuit—an attack known as a correlation attack—Tor applies strict exclusion rules during the middle relay selection process:

• Distinct /16 IPv4 Subnets: Tor will not select a middle relay that shares the same /16 IPv4 subnet (or /32 for IPv6) with the circuit’s guard or exit relay. This ensures that nodes hosted within the same data center or network block cannot be used together.
• The “MyFamily” Declaration: Node operators who run multiple relays are required to configure a MyFamily setting linking their servers. Tor treats all relays in a declared family as a single entity, ensuring no two nodes from the same operator appear in the same path.
• No Duplicate Nodes: A relay cannot occupy more than one position within a single circuit.

Once all candidate relays violating these diversity rules are filtered out, the Tor client makes a weighted probabilistic choice from the remaining valid nodes to finalize the three-hop path.