Guard Node
The guard node is the first relay of a Tor circuit. It sees the user's IP address, but on encrypted connections not the actual destination. Tor keeps guards for a longer period so a user does not constantly meet new, potentially malicious entry nodes. Selection is automatic by the client.
Why the entry rarely changes
Intuitively, frequent switching feels safer. For the entry position the opposite is true. Drawing a new first hop on every circuit gives an attacker who controls a small share of the network another chance to occupy that position. Over many connections a hit becomes almost certain. A small set of guards kept for weeks turns the math around: either you start with a malicious guard, or you are protected from that for the period.
What the guard sees
The guard knows the IP of the access connection and knows that Tor is being used. The final destination stays hidden because it sits under further encryption layers that later relays remove — the principle of Onion Routing. Guard and Exit Node together could link a connection; that is why the client avoids paths where both belong to the same operator family or the same network range.
When the entry stands out
On networks where even recognizable Tor use is a risk, the guard mechanism does not help, because the connection to a known relay is visible from outside. For that case there are Bridges, which take the place of a regular guard and are not publicly listed.
Category: Network