0

For example, I have set up the Tor network in Debian. I then set up proxy in Iceweasel browser (via the Preferences).

How can I examine the traffic chain to determine if browser requests first go through Tor and then through the proxy, or directly through the proxy, bypassing Tor? I am interested in this for examining the traffic chain in Debian and similar Windows configurations.

Improve this question
5
  • You mean, besides packet captures?
    – schroeder ♦
    May 15, 2016 at 20:25
  • @ideloxew - product recommendations are off-topic on this site. Questions asking for them will generally get closed. I hope I've captured the heart of your question with my edit to focus on your problem and not a product recommendation. You should feel free to re-edit the question if you wish.
    – Neil Smithline
    May 15, 2016 at 23:37
  • @schroeder what you mean "besides packet captures"?
    – ideloxew
    May 16, 2016 at 8:06
  • @ideloxew you ask how to inspect that traffic chain, and that is typically done with packet captures (i.e. inspecting the packets). I'm asking if you are looking for a way to inspect that traffic that isn't about inspecting the packets.
    – schroeder ♦
    May 16, 2016 at 14:35
  • @schroeder Thanks for explanation. Actually I'm newbie in this field. All what I want to do - it's look at the chain of IP addresses from my browser (because proxy configured in Iceweasel) to the Internet.
    – ideloxew
    May 16, 2016 at 15:00

2 Answers 2

Reset to default
1

There is no way to do it with "external" tools. Because the information about the circuits is kept within Tor.

However you can utilise Tor's control protocol. This means you can connect to your Tor client and extract information out of your client. So sending GETINFO circuit-status prints out information to your current circuit(s). Usually Tor opens several circuits in parallel. So it's not easy to say which circuit was used for which connection. See the Path specification for more details. Roger Dingledine explained also some things in this answer on Tor.SE.

Improve this answer
2
  • But how I can look at proxy in the chain? As you can see in the original question was to specify - that the chain is not only used the Tor, but also a proxy. And it is used separately.
    – ideloxew
    May 19, 2016 at 5:22
  • I'm sorry, but I don't understand what you're trying to say. Could you explain a bit more in detail?
    – qbi
    May 19, 2016 at 7:03
0

You can use proxychains. It's pretty adjustable, it shows you the status of each part of the chain and always obeys your order specification, unless it fails totally.

This works on Ubuntu, so the process will be similar on Debian

$ sudo apt-get install proxychains
$ sudo nano /etc/proxychains.conf

Make sure dynamic_chain is commented

#dynamic_chain

And that strict_chain is uncommented

strict_chain

Scroll all the way down and change

socks4  127.0.0.1 9050

to

socks5 127.0.0.1 9050

Now, just add any proxy you want (on new line, you can add as many as you want)

You can see the supported proxy types:

proxy types: http, socks4, socks5

Now just type

$ proxychains iceweasel

And it will obey your proxy chain. You can see each part working in the terminal.

Protip: This is is useful against CloudFlare's Tor captcha.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .