I often read that your ISP can tell if you are using Tor. Assuming you use a bridge the only way to do this seems to be statistical analysis of a packet capture. How exactly is this done given that the initial connection is over TLS and can you prevent it?
Standard Tor traffic
Default Tor entry nodes are publicly listed. So, to block a standard Tor connection, your ISP just needs to check the IPs you're connecting to against a list of known nodes (called "entry guards").
For example, my Tor browser randomly chose
126.96.36.199 as the entry point from a list of public nodes. Now, an eavesdropper could just look up the IP on Atlas (you can filter guard nodes with
flag:Guard) to conclude I'm a Tor user.
Bridges are unlisted Tor relays and therefore can't be blocked as easily. But research suggests that bridges can potentially be identified by analyzing their incoming and outgoing traffic (as linked in @user169339's answer).
Another option for an eavesdropper is to employ DPI to inspect your initial TLS handshake when connecting to the Tor network. E.g., the authors of the paper Detecting and blocking onion router traffic using deep packet inspection observed some characteristics which can be easily deployed as firewall rules, among them:
The cipher suites offered by the Tor client are always the same.
ClientHellomessage, the indicated
server_nameis always a random domain name in the form of
Subject and issuer of the certificate presented during the handshake also have this random domain set in the
commonNamefield which should be easy to distinguish from legitimate certificates.
In a quick test I could successfully sniff some pseudo domains from a Tor TLS handshake:
(Even the random domains alone, although you might not be able to filter them reliably, could certainly attract the attention of your local sysadmin.)
Pluggable transports are the Tor project's attempt to overcome DPI-based blocking by providing an API to exchange Tor traffic over arbitrary (obscured) protocols which are harder for firewalls to detect:
Pluggable Transports help you bypass censorship against Tor.
Pluggable Transports (PT) transform the Tor traffic flow between the client and the bridge. This way, censors who monitor traffic between the client and the bridge will see innocent-looking transformed traffic instead of the actual Tor traffic. External programs can talk to Tor clients and Tor bridges using the pluggable transport API, to make it easier to build interoperable programs.
You are partially correct. Statistical analysis is the route to take, but it is the packet metadata and not payload that will allow the ISP to detect Tor. At the following link, they talk about an 86.7% online detection rate and their method for detection. I have a colleague that is able to do it at ~97% using inter-packet timing, packet sizes, etc. With that said, I don't know of any commercial products that are currently blocking Tor bridges so if ISP's are truly detecting/blocking them I'm guessing it's done with in-house solutions. Maybe DarkTrace?
You can attempt to hide from your ISP that you are connecting to TOR, by connecting to a TOR bridge, which is a secret TOR entry node. In this case, your ISP will see a TLS connection between your client and the unrecognized TOR bridge's IP address. On the surface, it will look not much different than a typical TLS connection used for https, or VOIP calls, video calls, etc.
But, if your ISP has reason to be 'curious', and they decide to dig deeper, they will probably be able to detect very quickly that the server that you are connecting to is in fact a TOR node. They can simply connect to the node using TLS and start sending commands used with TOR protocol (such as AUTHENTICATE, signal, NEWNYM, QUIT). When they see that the node responds to these commands, they'll know that this is in fact a TOR node.