I have read some articles about how Tor works. I know about layer by layer decryption, but there is something that I cannot understand:

If the exit node is the one that does the last decryption and sees the plain text, so it could know about my real IP address which is included in the http header. How does Tor deal with this? Does the client include it's IP address in the main packet at all?

  • 4
    I don't know what kind of header of what kind of protocol you are talking, but if you are talking about HTTP: No, the client IP is not part of the header. It's part of the underlying IP protocol, and that's what TOR is covering.
    – Philipp
    Jan 25, 2016 at 20:21
  • Yes, I was exactly mean the HTTP. So you're saying that my IP address is stored somewhere that the exit node do not have access to it. Am I right? If so, the question is, that every packet that travels throgh the network has the source and destination address. As long as my computer includes thease information in the data it sends, it could be visible to the node which sees the plain text data (in this case the exit node) - even if the payload is encrypted. Now, how could it be still anonymous?
    – ttvd94
    Jan 27, 2016 at 5:22
  • 1
    Not your address, the address of the relay node from which the exit node received your request. Only the entry node knows you address, after that, each node in the chain only knows the address of the previous node.
    – Teun Vink
    Jan 27, 2016 at 5:32
  • Ok @Teun Vink, so my Tor application does this, but what aboud the data coming back? The server may not be using the Tor network, so it would send its IP address to me. The result is the entry node knowing my destination address.
    – ttvd94
    Jan 28, 2016 at 22:13
  • To quote torproject.org/docs/faq.html.en#WhatIsTor: A bad first of three servers can see encrypted Tor traffic coming from your computer. It still doesn't know who you are and what you are doing over Tor. It merely sees "This IP address is using Tor". Keep in mind that Tor is a proxy network, not a set of routers forwarding IP packets.
    – Teun Vink
    Jan 29, 2016 at 5:10

2 Answers 2


The exit node will not know your address. The principle is that every server only knows the address of the previous and the next host but never the whole path. There are three steps between your TOR browser and the webserver:

  • Entry-Node (Knows your address and relay nodes address)
  • Relay-Node (knows entry-node and exit-node address)
  • Exit-Node (knows address of relay-node and webserver)

The packet you send is traveling this chain and the answer is travelling the same chain backwards. When you use HTTPS none of that TOR servers will ever know the content of packages sent/received. What they all do is adding encryption on top of your connecten even if it is already encrypted using SSL.

// Like in NAT the TOR-Nodes will replace the Source address of the IP-Packet with their own Adresse. The packets are then encrypted between the nodes. The only node that knows your address is the entry node which stores this information in the memory and will or should at least never store it permanently .

  • Thanke you and yes, I know about that. Please read the conversation with Philipp above. I tried more clearing the question.
    – ttvd94
    Jan 27, 2016 at 5:25
  • What happens to the main data (the packet that has my IP address and gets three times encryption)? Since it's only the exit node which could see and change the source address in it.
    – ttvd94
    Jan 28, 2016 at 22:24
  • The payload gets encrypted and forwarded not the metadata - which includes your ip address. Your IP-Adtess is in no way part of the packet that reaches the exit node!
    – davidb
    Jan 29, 2016 at 0:25
  • so how the exit node knows the address of the server that the packet should be delivered to? Shouldn't it have the metadata?
    – ttvd94
    Feb 1, 2016 at 7:23
  • 1
    The request contains the destination of the packet but not your IP-Address. Like I wrote: In this regard it acts like a NAT router!
    – davidb
    Feb 1, 2016 at 8:16

When you use Tor your Internet traffic is routed via Tor which goes through several random relays before exiting the Tor network. Tor is "designed" so that it is theoretically impossible to know the original computer that the information came from assuming you are using Tor the right way. Exit node can see your plaintext traffic assuming you aren't using HTTPS. Theres an article in 2007 some researchers intercepted emails and passwords from hundreds of users just by running a simple Exit Node. As long as you use HTTPS you should be fine. Tor does not leak your identify, it is the users who dont use tor correctly who are responsible for the leakage. Here's a list of some common mistakes tor users make that could reveal information about the original user up to leaking the actual ip address.

  • Changing proxy settings
  • Installing browser add-ons
  • Installing/Using plugins such as Flash
  • Some recommend to disable Javascript altogether *- Example: Vulnerability uncovered in Windows firefox & chrome "new ip check" option allows sites to determine users actual IP even when using VPN, because Javascript code within visitors browser can
    executed behind the scenes without users ever knowing see Reddit Post.
  • Always keep browser updated - Vulnerabilities - Leak information Example: Browser vulnerability may reveal users real IP Address
    Site: Real IP Leak - Browser Vulnerability
    Site: 0day Javascript Firefox Flaw
  • Even simply watching a video, video player the browser may be using may leak your information
  • Avoid DNS Leaks When your browser is not setup correctly and queries DNS directly instead via VPN/Tor all your anonymity is lost. How DNS Leaks Can Destroy Anonymity

There are many many more possibilities but under proper usage, using the tor bundle, up-to-date, w/o javascript, forcing https, disabling all add-ons and plugins, although still not full-proof (maybe the Russians have 0-day exploit?) but will GREATLY reduce your chance of exposing your identity.

Best of luck, eof0100

  • Thanke you for your reply, but I meant about the pain text data that the exit node can have. Please read the conversation with Philipp above. I tried more clearing the question.
    – ttvd94
    Jan 27, 2016 at 5:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .