I know that a website's javascript application can open direct connections with my computer, outside the onion network, and that way the real ip of the Tor Browser user ends up being revealed. How can I evaluate if a particular site is actually "seeing" my real ip or if it is seeing just the tor exit node's ip?

  • Bypassing Tor would require a security vulnerability in Tor Browser. Commented May 8, 2017 at 14:52
  • If you're paranoid, go with Whonix over the Tor Browser Bundle. That way no application running on the workstation VM can bypass Tor without a vulnerability in the gateway VM, reducing the attack surface. Commented May 8, 2017 at 14:53
  • But can't I check it? I understand that I can see all connections made by my computer right now with netstat, for example. Maybe a "tor netstat" has been developed? Is "arm" something like that? Commented May 8, 2017 at 17:31
  • Connections to the remote end-point of are through Tor. You can use netstat or wireshark for that. But netstat won't show you DNS or UDP based leaks and with wireshark it's annoying to restrict the connections to those originating from Tor Browser (at least that's what I remember, I'm hardly a wireshark expert) Commented May 8, 2017 at 17:42

1 Answer 1


JavaScript cannot bypass proxy settings in Firefox. The only way it can is by exploiting a new bug in the JavaScript engine which allows complete control over Firefox, allowing the proxy settings to be ignored. Features that are able to bypass the proxy settings at will include Flash and Java (unrelated to JavaScript), and those are not included in Tor Browser for that reason.

Detecting a bypass attempt can generally only be successfully done if you are detecting a successful bypass attempt. Assuming you are using Linux, this can be done safely by using iptables, which is the frontend for the system's firewall. If you make Tor run as its own user (for example, by using Tor in a distro's repository), you can set iptables to deny all network connections which are not coming from the dedicated Tor user. Violations can then be logged.

The Tails live operating system does this. All applications on Tails are configured to only go over Tor, and any applications which try to connect to the internet directly (whether due to being misconfigured, or having been compromised) will be blocked, with logs sent to the system log.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .