seeing various requests on tcpdump about archtorify HOT 4 CLOSED

(I removed the MAC addresses from the output).
I need to run tests on this to be able to answer you fully, anyway connections are probably related to your network configuration.
Are you using archtorify on a regular version of Arch Linux or on Manjaro?

from archtorify.

@brainfucksec thanks for the MAC.
it is a regular version of Arch Linux.
should i use a firewall? i generally use ufw with this settings https://askubuntu.com/questions/1005312/ufw-firewall-deny-outgoing-but-allow-browser
but currently ufw seems inactive. Will using ufw with above settings affect archtorify?

from archtorify.

archtorify sets iptables rules, so any firewall or DNS-related applications must be disabled, see: How to run archtorify.

From the ss command output the Tor guard IP is the IP address under the PEER entry, I ran the test now and there is no connections in the output, the test should be performed without any browser opened or application that making network connections.
As stated in the README, the Network configuration of Arch Linux users is very variable, it depends how your network is configured (whether with dhcpcd, systemd-networkd etc.).

From the output you showed I see that there are connections related to BOOTP service, evidently there is a server on the network that has this service set up.
See:

• https://en.wikipedia.org/wiki/Bootstrap_Protocol
• https://wiki.archlinux.org/title/Preboot_Execution_Environment

from archtorify.

thanks!

from archtorify.