Function _tor_exit_check

network_diagnostics.py:800–818

Authoritatively detect whether egress through `iface` leaves via a Tor exit node, by asking the Tor Project's own checker (which sees our exit IP). This is the only reliable way to catch Tor/VPN running on the *router*: in that case Ragnar's own interface is an ordinary LAN NIC, so the

(iface)

        if action == 'reset':
            _arp_baseline_save({})
            return {'success': True, 'reset': True, 'gateways': {}}
        return {'success': True, 'gateways': (_arp_baseline_load().get('gateways') or {})}


def do_arp_check(interface=None, learn=True):
    """Detect ARP spoofing / poisoning from the kernel neighbour table.

    Signals: (1) the default gateway's MAC no longer matches the trusted
    baseline — the classic MITM signature (an attacker ARP-replies as the
    gateway to intercept traffic); (2) one MAC answering for many IPs — a host
    impersonating much of the subnet. First run learns the gateway baseline.

    verdict: 'spoofed'    -- gateway MAC changed from the trusted baseline
             'suspicious' -- a MAC is impersonating several IPs
             'clean'      -- gateway matches baseline, no impersonators
             'unknown'    -- no gateway, or its MAC couldn't be resolved

    With `interface` set, the check is scoped to that segment: its own default
    gateway (a higher-metric uplink still counts) and only the neighbours on that
    interface — the right lens on a multi-homed box."""
    iface = interface if _valid_iface(interface or '') else None
    gw = _iface_gateway(iface) if iface else _default_gateway()