0

I created an SSH SOCKS tunnel that forwards connections from a local port to a remote server: ssh -N -D 127.0.0.1:1234 [email protected] (i.e. all connections to 127.0.0.1:1234 get forwarded to the example.com server). I then configured the Tor Browser to connect to Tor via the 127.0.0.1:1234 SOCKS5 proxy.

If I browse the web using the Tor Browser, can my ISP know that I am using Tor by looking at the SSH traffic between my computer and the example.com remote server?

Improve this question

2 Answers 2

Reset to default
1

No, your ISP cannot tell you are using Tor.

Your ISP probably can tell you are using SSH as a proxy, but they have no way to identify what you are connecting on the other side of the proxy. They cannot tell if the endpoint is connecting direct to the internet, to a VPN server, or to Tor.

Improve this answer
5
  • 2
    Can't the ISP use network traffic analysis to deduce that an SSH connection is carrying Tor data?
    – Flux
    Commented Apr 19, 2022 at 2:27
  • The ISP might not be able to tell that you're using TOR, but they can certainly tell from packet sizes and timings that you're not doing typical SSH things.
    – Mark
    Commented Apr 19, 2022 at 3:30
  • OP wants to know if ISP can tell they are using Tor, not if they are using SSH in unconventional ways.
    – ThoriumBR
    Commented Apr 19, 2022 at 13:40
  • @Flux no, they cannot. SSH traffic is encrypted, and ISP can only know OP is using SSH as a proxy, but not what kind of proxy OP is using.
    – ThoriumBR
    Commented Apr 19, 2022 at 13:41
  • Don't forget that SSH is the traffic ISP is looking at. Tor is encapsulated, so packet size is SSH packet size. Tor only takes over outside of the tunnel.
    – ThoriumBR
    Commented Apr 21, 2022 at 18:28
0

Easy answer is not really, but...

SSH can use a variety of encryption algorithms, chosen during the negotiation and setup phase. To my knowledge, these are all considered secure at this time, discounting attacks which are not against the protocol itself (eg, compromised executables, etc). So, the ISP will not be able to read your actual traffic to see what you are doing.

However, the SSH traffic pattern will be unusual for a typical SSH session. Anyone doing a frequency analysis will see that you are doing some kind of unusual activity, but will your ISP really care and take the time to do that analysis? Probably not.

If you are using a trusted version of the TOR browser, and don't have any other compromised binaries on your source or destination hosts, you are probably good for TOR.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .