if an exit node decides to trace back a Tor message to its source, will it be able to identify the same packet at the middle node, and from then identify the same packet at the entry node? assuming they have access to the internet logs of all nodes. As I understand the identity of the middle node will be obvious to the exit node. And the entry node identity is also obvious to the middle node.

I'm asking this to understand if, with access to the right logs, is it guaranteed that someone can identify the source and destination of any Tor message. I'm not asking about time correlation at the entry/exit nodes.

  • "with access to the right logs" - which logs? Proper Tor nodes don't have access logs. So the attacker need to already control all nodes involved to do the correlation. Feb 1, 2023 at 18:32
  • 1
    How would they have assuming they have access to the internet logs of all nodes unless they control all the nodes which is basically impossible? Feb 1, 2023 at 19:44
  • @SirMuffington, agreed. But, apparently this is not stopping one group from trying: malwarebytes.com/blog/news/2021/12/…
    – mti2935
    Feb 3, 2023 at 17:02
  • @mti2935 I'm well aware of this russian try to deanonimize users, it's not quite taking all of it over when only max 10% of traffic was spied upon Feb 3, 2023 at 18:09

1 Answer 1


If we assume that all nodes a package traverses over actually create logs and someone has access to all of these logs then yes, a Tor package can be traced back.

Is it feasible? No, not really. Tor by itself does not create logs. A malicious actor can of course modify this so any traffic over the node gets logged. This scenario requires that all of these nodes are under the control of the same actor so that all are running the modified software.

I very much assume that quite some Tor nodes are under the control of some agencies. But it is very unlikely that a connection uses only nodes controlled by the same agency.

For cases in which this 'unlikely' is still too high of a likelihood, only the previous/next hope around the Tor network would be known. Anyone that serious about the privacy of the connection should ensure to add additional layers around. Of course, it will be a trade-off between usable speed and anonymity.

  • I'm thinking LE agencies being able to take the logs from ISPs directly. Afaik most nodes are in western countries, and if they deem someone to be a great threat, wouldn't this be very feasible?
    – Dhari
    Feb 2, 2023 at 7:27
  • @Dhari ISP's can see the source address and destination address of a packet traversing between two Tor nodes, but the payloads of these packets are of course encrypted. From this header information, there is no logical way to correlate a packet arriving at a Tor node with a packet leaving a Tor node - other than the correlation in time between these packets. You specifically excluded timing correlation in the last sentence of your question, but it's widely believed that entities that are able to surveil large swaths of the internet (e.g. the NSA) are doing this.
    – mti2935
    Feb 3, 2023 at 17:10
  • May I know why (without time correlation) you can't see the packet going and out of a node with the perspective of an ISP? Is the next node's address hidden under the outer layer of encryption? I believe I missed this point when I first wrote my question
    – Dhari
    Feb 3, 2023 at 20:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .