I often read that your ISP can tell if you are using Tor. Assuming you use a bridge the only way to do this seems to be statistical analysis of a packet capture. How exactly is this done given that the initial connection is over TLS and can you prevent it?

  • the nodes are known - the first hop can be traced – schroeder Feb 12 '18 at 22:35
  • 2
    @schroeder OP assumes a bridge is used (which naturally isn't publicly listed). – Arminius Feb 12 '18 at 23:12

Standard Tor traffic

Default Tor entry nodes are publicly listed. So, to block a standard Tor connection, your ISP just needs to check the IPs you're connecting to against a list of known nodes (called "entry guards").

For example, my Tor browser randomly chose as the entry point from a list of public nodes. Now, an eavesdropper could just look up the IP on Atlas (you can filter guard nodes with flag:Guard) to conclude I'm a Tor user.

With bridges

Bridges are unlisted Tor relays and therefore can't be blocked as easily. But research suggests that bridges can potentially be identified by analyzing their incoming and outgoing traffic (as linked in @user169339's answer).

Another option for an eavesdropper is to employ DPI to inspect your initial TLS handshake when connecting to the Tor network. E.g., the authors of the paper Detecting and blocking onion router traffic using deep packet inspection observed some characteristics which can be easily deployed as firewall rules, among them:

  • The cipher suites offered by the Tor client are always the same.

  • In the ClientHello message, the indicated server_name is always a random domain name in the form of www.[a-z0-9].[com|net].

  • Subject and issuer of the certificate presented during the handshake also have this random domain set in the commonName field which should be easy to distinguish from legitimate certificates.

In a quick test I could successfully sniff some pseudo domains from a Tor TLS handshake:


(Even the random domains alone, although you might not be able to filter them reliably, could certainly attract the attention of your local sysadmin.)

Pluggable transports

Pluggable transports are the Tor project's attempt to overcome DPI-based blocking by providing an API to exchange Tor traffic over arbitrary (obscured) protocols which are harder for firewalls to detect:

Pluggable Transports help you bypass censorship against Tor.

Pluggable Transports (PT) transform the Tor traffic flow between the client and the bridge. This way, censors who monitor traffic between the client and the bridge will see innocent-looking transformed traffic instead of the actual Tor traffic. External programs can talk to Tor clients and Tor bridges using the pluggable transport API, to make it easier to build interoperable programs.

| improve this answer | |
  • Thank you. Do pluggable transports just randomise ports or do they take any other steps to hide the traffic? – monaco Feb 13 '18 at 7:16
  • @monaco It's not just about randomizing ports but obscuring the protocol. E.g. there is a PT called SkypeMorph which makes Tor traffic look like Skype video. The most widespread PT though I think is obfs4. – Arminius Feb 13 '18 at 13:19

You are partially correct. Statistical analysis is the route to take, but it is the packet metadata and not payload that will allow the ISP to detect Tor. At the following link, they talk about an 86.7% online detection rate and their method for detection. I have a colleague that is able to do it at ~97% using inter-packet timing, packet sizes, etc. With that said, I don't know of any commercial products that are currently blocking Tor bridges so if ISP's are truly detecting/blocking them I'm guessing it's done with in-house solutions. Maybe DarkTrace?

| improve this answer | |
  • That's a very interesting paper you have linked. In fact it seems there are even more recent papers claiming near 100 perfect success even with pluggable transports. – monaco Feb 13 '18 at 7:18
  • Do you have the name or link to the paper(s)? Thanks! – user169339 Feb 13 '18 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.