0

For example, I have set up the Tor network in Debian. I then set up proxy in Iceweasel browser (via the Preferences).

How can I examine the traffic chain to determine if browser requests first go through Tor and then through the proxy, or directly through the proxy, bypassing Tor? I am interested in this for examining the traffic chain in Debian and similar Windows configurations.

|improve this question
  • You mean, besides packet captures? – schroeder♦ May 15 '16 at 20:25
  • @ideloxew - product recommendations are off-topic on this site. Questions asking for them will generally get closed. I hope I've captured the heart of your question with my edit to focus on your problem and not a product recommendation. You should feel free to re-edit the question if you wish. – Neil Smithline May 15 '16 at 23:37
  • @schroeder what you mean "besides packet captures"? – ideloxew May 16 '16 at 8:06
  • @ideloxew you ask how to inspect that traffic chain, and that is typically done with packet captures (i.e. inspecting the packets). I'm asking if you are looking for a way to inspect that traffic that isn't about inspecting the packets. – schroeder♦ May 16 '16 at 14:35
  • @schroeder Thanks for explanation. Actually I'm newbie in this field. All what I want to do - it's look at the chain of IP addresses from my browser (because proxy configured in Iceweasel) to the Internet. – ideloxew May 16 '16 at 15:00
1

There is no way to do it with "external" tools. Because the information about the circuits is kept within Tor.

However you can utilise Tor's control protocol. This means you can connect to your Tor client and extract information out of your client. So sending GETINFO circuit-status prints out information to your current circuit(s). Usually Tor opens several circuits in parallel. So it's not easy to say which circuit was used for which connection. See the Path specification for more details. Roger Dingledine explained also some things in this answer on Tor.SE.

|improve this answer
  • But how I can look at proxy in the chain? As you can see in the original question was to specify - that the chain is not only used the Tor, but also a proxy. And it is used separately. – ideloxew May 19 '16 at 5:22
  • I'm sorry, but I don't understand what you're trying to say. Could you explain a bit more in detail? – qbi May 19 '16 at 7:03
0

You can use proxychains. It's pretty adjustable, it shows you the status of each part of the chain and always obeys your order specification, unless it fails totally.

This works on Ubuntu, so the process will be similar on Debian

$ sudo apt-get install proxychains
$ sudo nano /etc/proxychains.conf

Make sure dynamic_chain is commented

#dynamic_chain

And that strict_chain is uncommented

strict_chain

Scroll all the way down and change

socks4  127.0.0.1 9050

to

socks5 127.0.0.1 9050

Now, just add any proxy you want (on new line, you can add as many as you want)

You can see the supported proxy types:

proxy types: http, socks4, socks5

Now just type

$ proxychains iceweasel

And it will obey your proxy chain. You can see each part working in the terminal.

Protip: This is is useful against CloudFlare's Tor captcha.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.