Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking at the results from the following URL and would like to know how does the TOR website "know" that TOR is being used or not.


I would set up a packet sniffer, but since I'm not an exit node I'm not sure if that would make much of a difference.

share|improve this question

3 Answers 3

up vote 16 down vote accepted

In one line: they have a list of all the exit nodes (something like that).

more detailed:

I have seen this post demonstrates how to detect a Tor connection in php

function IsTorExitPoint(){
    if (gethostbyname(ReverseIPOctets($_SERVER['REMOTE_ADDR']).".".$_SERVER['SERVER_PORT'].".".ReverseIPOctets($_SERVER['SERVER_ADDR']).".ip-port.exitlist.torproject.org")=="") {
        return true;
    } else {
       return false;

function ReverseIPOctets($inputip){
    $ipoc = explode(".",$inputip);
    return $ipoc[3].".".$ipoc[2].".".$ipoc[1].".".$ipoc[0];

A good references explain what it does are available here:

share|improve this answer
Could you update your php function to support IPv6? –  lucek Dec 22 '14 at 12:54

They know what are the TOR exit nodes addresses. So they just check your address and see if it matches with one of the exit nodes.

Exit nodes are known to the whole TOR network, if you decide to run one exit node, then you should advertise it right? Or else no one will use it. Then people will know your IP is a ToR exit node. Simple.

share|improve this answer
You have to advertise your Tor relay IP address, but Tor users have no need to know your exit IP address. –  curiousguy Jun 17 '12 at 21:46
@Aki What about NAT'ed addresses? Or can TOR exit nodes not be NAT'ed? –  Eugene Beresovsky Oct 24 '12 at 4:47
Yup I just tried this: When running an exit node myself, I can go to check.torproject.org in any unconfigured browser and it will happily report I'm using Tor. –  Luc Aug 15 '13 at 23:24

You can check if a connection is a tor exit point by using TorDNSEL; Thus a script can be coded to check every connection.

"TorDNSEL is an implementation of the active testing, DNS-based exit list for Tor exit nodes. "

share|improve this answer
Can you translate the implementation notes in the TorDNSEL README file? "TorDNSEL can perform active exit testing by launching an HTTP request to itself through every exit node with a suitable exit policy. This allows it to detect exit nodes configured to send outbound connections through a different IP address from the one they advertise in their descriptors. When configured to run exit tests, it tests through a particular exit node each time the node publishes a new descriptor. All running nodes are tested periodically between descriptor uploads." –  logicalscope Mar 4 '12 at 6:24
@logicalscope - Well yes, it makes sense. TorDNSEL, being a TOR node itself (part of TOR network), issues a HTTP request to other available TOR nodes that targets it's public IP HTTP server. Exit nodes accept this request as outbound traffic, forward it on TorDNSEL's behalf, and all TorDNSEL needs to do is collect IPs that forwarded that request. The list it ends up with is public IPs of current TOR exit nodes. –  TildalWave Jan 30 '13 at 2:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.