Quote from: vinshet on May 05, 2022, 08:42:03 AM

I have a pruned BTC node running over TOR with onlynet= onion and upon startup this node has 10 outgoing connections all to onion addresses. Question is, where does the node get the onion addresses from?

Your questions are pretty well explained in the Mastering Bitcoin book.

As explained in Network Discovery:

Quote from: https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch08.asciidoc#network-discovery

When a new node boots up, it must discover other Bitcoin nodes on the network in order to participate. To start this process, a new node must discover at least one existing node on the network and connect to it.

[...]

How does a new node find peers? The first method is to query DNS using a number of "DNS seeds," which are DNS servers that provide a list of IP addresses of Bitcoin nodes. Some of those DNS seeds provide a static list of IP addresses of stable bitcoin listening nodes. Some of the DNS seeds are custom implementations of BIND (Berkeley Internet Name Daemon) that return a random subset from a list of Bitcoin node addresses collected by a crawler or a long-running Bitcoin node. The Bitcoin Core client contains the names of nine different DNS seeds. The diversity of ownership and diversity of implementation of the different DNS seeds offers a high level of reliability for the initial bootstrapping process. In the Bitcoin Core client, the option to use the DNS seeds is controlled by the option switch -dnsseed (set to 1 by default, to use the DNS seed).

Alternatively, a bootstrapping node that knows nothing of the network must be given the IP address of at least one Bitcoin node, after which it can establish connections through further introductions. The command-line argument -seednode can be used to connect to one node just for introductions using it as a seed. After the initial seed node is used to form introductions, the client will disconnect from it and use the newly discovered peers.

[...]

Only one connection is needed to bootstrap, because the first node can offer introductions to its peer nodes and those peers can offer further introductions. It’s also unnecessary and wasteful of network resources to connect to more than a handful of nodes. After bootstrapping, a node will remember its most recent successful peer connections, so that if it is rebooted it can quickly reestablish connections with its former peer network. If none of the former peers respond to its connection request, the node can use the seed nodes to bootstrap again.

Quote from: vinshet on May 05, 2022, 08:42:03 AM

I understand that there are DNS seeders for bitcoin, but do they return onion addresses if they detect that the requesting node is running bitcoin over tor?

I'm pretty sure that if you use only Tor, you won't be using DNS at all, but instead will connect to a few given onion addresses that then give you more peer addresses which provide more and more (you get the idea), as explained above with the IP addresses in clearnet.

Quote from: vinshet on May 05, 2022, 08:42:03 AM

Also, I know that there is a list of hardcoded onion addresses in bitcoin core and I have observed that at times, the first outgoing connection is not from that list of nodes. Anyone have any idea why?

The hardcoded ones, as explained in the quotes above, are only used in the beginning or if the node has to re-bootstrap due to losing all connections.

Quote from: vinshet on May 05, 2022, 08:42:03 AM

Additionally, what do you think would be the merits/demerits of running a node on both TOR and IP?

If you use clearnet parallel to Tor, you won't get the highest level of security and privacy, for example from someone analyzing your network traffic. The merit is that you help the two networks to be connected and synced, in a way. If nobody ran clearnet + Tor nodes, there would be 2 separate networks that couldn't synchronize. Even worse, if mining pools were to only run clearnet nodes and there were no 'bridge nodes' that run both protocols, the Tor nodes would have no way to receive new blocks.

Quote from: vinshet on May 05, 2022, 08:42:03 AM

I'm trying to cover all grounds because I am collecting information of the current topology of the network and would like to have a complete view of the network. Any suggestions would be really appreciated.

I suggest the above linked book; it's widely available in paperback for reasonable price or online for free!