How does “check.torproject.org.” know if you're using TOR?

Question

I'm looking at the results from the following URL and would like to know how does the TOR website "know" that TOR is being used or not.

https://check.torproject.org/?lang=en-US&small=1&uptodate=1

I would set up a packet sniffer, but since I'm not an exit node I'm not sure if that would make much of a difference.

Answer 1

In one line: they have a list of all the exit nodes.

more detailed:

I have seen this post demonstrates how to detect a Tor connection in php

function IsTorExitPoint(){
    if (gethostbyname(ReverseIPOctets($_SERVER['REMOTE_ADDR']).".".$_SERVER['SERVER_PORT'].".".ReverseIPOctets($_SERVER['SERVER_ADDR']).".ip-port.exitlist.torproject.org")=="127.0.0.2") {
        return true;
    } else {
       return false;
    } 
}

function ReverseIPOctets($inputip){
    $ipoc = explode(".",$inputip);
    return $ipoc[3].".".$ipoc[2].".".$ipoc[1].".".$ipoc[0];
}

A good references explain what it does are available here:

• Here is the list of the exit nodes.
• Here is a page maintained by the Tor project, that explains how to determine if it is Tor.

Answer 2

They know what are the TOR exit nodes addresses. So they just check your address and see if it matches with one of the exit nodes.

Exit nodes are known to the whole TOR network, if you decide to run one exit node, then you should advertise it right? Or else no one will use it. Then people will know your IP is a ToR exit node. Simple.

Answer 3

You can check if a connection is a tor exit point by using TorDNSEL; Thus a script can be coded to check every connection.

"TorDNSEL is an implementation of the active testing, DNS-based exit list for Tor exit nodes. "