I often read that your ISP can tell if you are using Tor. Assuming you use a bridge the only way to do this seems to be statistical analysis of a packet capture. How exactly is this done given that the initial connection is over TLS and can you prevent it?


3 Answers 3


Standard Tor traffic

Default Tor entry nodes are publicly listed. So, to block a standard Tor connection, your ISP just needs to check the IPs you're connecting to against a list of known nodes (called "entry guards").

For example, my Tor browser randomly chose as the entry point from a list of public nodes. Now, an eavesdropper could just look up the IP on Atlas (you can filter guard nodes with flag:Guard) to conclude I'm a Tor user.

With bridges

Bridges are unlisted Tor relays and therefore can't be blocked as easily. But research suggests that bridges can potentially be identified by analyzing their incoming and outgoing traffic (as linked in @user169339's answer).

Another option for an eavesdropper is to employ DPI to inspect your initial TLS handshake when connecting to the Tor network. E.g., the authors of the paper Detecting and blocking onion router traffic using deep packet inspection observed some characteristics which can be easily deployed as firewall rules, among them:

  • The cipher suites offered by the Tor client are always the same.

  • In the ClientHello message, the indicated server_name is always a random domain name in the form of www.[a-z0-9].[com|net].

  • Subject and issuer of the certificate presented during the handshake also have this random domain set in the commonName field which should be easy to distinguish from legitimate certificates.

In a quick test I could successfully sniff some pseudo domains from a Tor TLS handshake:


(Even the random domains alone, although you might not be able to filter them reliably, could certainly attract the attention of your local sysadmin.)

Pluggable transports

Pluggable transports are the Tor project's attempt to overcome DPI-based blocking by providing an API to exchange Tor traffic over arbitrary (obscured) protocols which are harder for firewalls to detect:

Pluggable Transports help you bypass censorship against Tor.

Pluggable Transports (PT) transform the Tor traffic flow between the client and the bridge. This way, censors who monitor traffic between the client and the bridge will see innocent-looking transformed traffic instead of the actual Tor traffic. External programs can talk to Tor clients and Tor bridges using the pluggable transport API, to make it easier to build interoperable programs.

  • Thank you. Do pluggable transports just randomise ports or do they take any other steps to hide the traffic?
    – monaco
    Feb 13, 2018 at 7:16
  • @monaco It's not just about randomizing ports but obscuring the protocol. E.g. there is a PT called SkypeMorph which makes Tor traffic look like Skype video. The most widespread PT though I think is obfs4.
    – Arminius
    Feb 13, 2018 at 13:19

You are partially correct. Statistical analysis is the route to take, but it is the packet metadata and not payload that will allow the ISP to detect Tor. At the following link, they talk about an 86.7% online detection rate and their method for detection. I have a colleague that is able to do it at ~97% using inter-packet timing, packet sizes, etc. With that said, I don't know of any commercial products that are currently blocking Tor bridges so if ISP's are truly detecting/blocking them I'm guessing it's done with in-house solutions. Maybe DarkTrace?

  • That's a very interesting paper you have linked. In fact it seems there are even more recent papers claiming near 100 perfect success even with pluggable transports.
    – monaco
    Feb 13, 2018 at 7:18
  • Do you have the name or link to the paper(s)? Thanks!
    – user169339
    Feb 13, 2018 at 16:59

You can attempt to hide from your ISP that you are connecting to TOR, by connecting to a TOR bridge, which is a secret TOR entry node. In this case, your ISP will see a TLS connection between your client and the unrecognized TOR bridge's IP address. On the surface, it will look not much different than a typical TLS connection used for https, or VOIP calls, video calls, etc.

But, if your ISP has reason to be 'curious', and they decide to dig deeper, they will probably be able to detect very quickly that the server that you are connecting to is in fact a TOR node. They can simply connect to the node using TLS and start sending commands used with TOR protocol (such as AUTHENTICATE, signal, NEWNYM, QUIT). When they see that the node responds to these commands, they'll know that this is in fact a TOR node.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .