guard 中继

guard 中继是你 tor 线路固定的第一跳 - 连续数月保持同一个,这样没有单个观察者能同时看到你的流量进出网络。

every tor circuit starts at a guard relay (also called an entry relay), the first hop that receives your encrypted traffic and forwards it onward without being able to read it. your ip address is invisible to every other hop in the circuit.

the counterintuitive design decision is persistence. if tor picked a fresh first hop for every circuit, sooner or later an adversarial guard would catch some of your traffic - and statistically, frequent rotation guarantees that eventually the same adversary watches your entry and an exit at the same time. sticking with a small set of well-behaved guards for weeks or months minimizes that exposure, so tor deliberately pins them.

guards earn their flag through demonstrated bandwidth and uptime, so they tend to be large, stable relays run by long-lived operators. tor clients typically select one or two guards and rebuild ordinary circuits through them repeatedly.

you rarely need to think about guards day to day, but they explain two common observations: switching networks does not change your tor experience much, and tor metrics charts of relay counts dip noticeably whenever big guard operators retire hardware.