I created an SSH SOCKS tunnel that forwards connections from a local port to a remote server: ssh -N -D [email protected] (i.e. all connections to get forwarded to the example.com server). I then configured the Tor Browser to connect to Tor via the SOCKS5 proxy.

If I browse the web using the Tor Browser, can my ISP know that I am using Tor by looking at the SSH traffic between my computer and the example.com remote server?

2 Answers 2


No, your ISP cannot tell you are using Tor.

Your ISP probably can tell you are using SSH as a proxy, but they have no way to identify what you are connecting on the other side of the proxy. They cannot tell if the endpoint is connecting direct to the internet, to a VPN server, or to Tor.

  • 2
    Can't the ISP use network traffic analysis to deduce that an SSH connection is carrying Tor data?
    – Flux
    Apr 19, 2022 at 2:27
  • The ISP might not be able to tell that you're using TOR, but they can certainly tell from packet sizes and timings that you're not doing typical SSH things.
    – Mark
    Apr 19, 2022 at 3:30
  • OP wants to know if ISP can tell they are using Tor, not if they are using SSH in unconventional ways.
    – ThoriumBR
    Apr 19, 2022 at 13:40
  • @Flux no, they cannot. SSH traffic is encrypted, and ISP can only know OP is using SSH as a proxy, but not what kind of proxy OP is using.
    – ThoriumBR
    Apr 19, 2022 at 13:41
  • @ThoriumBR Flux means packet size and timing analysis
    – user253751
    Apr 21, 2022 at 16:08

Easy answer is not really, but...

SSH can use a variety of encryption algorithms, chosen during the negotiation and setup phase. To my knowledge, these are all considered secure at this time, discounting attacks which are not against the protocol itself (eg, compromised executables, etc). So, the ISP will not be able to read your actual traffic to see what you are doing.

However, the SSH traffic pattern will be unusual for a typical SSH session. Anyone doing a frequency analysis will see that you are doing some kind of unusual activity, but will your ISP really care and take the time to do that analysis? Probably not.

If you are using a trusted version of the TOR browser, and don't have any other compromised binaries on your source or destination hosts, you are probably good for TOR.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .