I feel that I generally understand TOR onion routing. From what I understand, the node knows the IP it is receiving data from and the IP it is sending data to. So surely a node can collect the IP addresses and filter out any other node IP addresses (publicly available) and then collect the rest. IP addresses that come up frequently could be accessed and regular TLDs like google could be excluded. If they aren't then it is more than likely that they are one of the popular .onion IP addresses.

Obviously this isn't hugely compromising since you don't know which .onion address it is but maybe more could be done once you have these addresses. Obviously it requires a node with a lot of traffic through it too but is it possible in theory?

Is this a reasonable assumption of the routing model? If not where did I go wrong?

  • "any other node IP addresses (publicly available)" is a bit of a misconception - it is only exit nodes that are publicly listed (because they interact with the wider WWW).
    – Bob Watson
    Feb 16, 2013 at 1:16
  • @BobWatson This is incorrect. All nodes are listed in the public relay descriptors released hourly (?) by the directory authorities. They fundamentally need to be public in order to allow a Tor client to have a set of identities to choose from when building the circuit. In fact, all relays, even historical ones that have only been a relay once, are listed.
    – forest
    Jan 2, 2018 at 9:18

1 Answer 1


You're talking about attacks by an adversary with a partial view of the network; which is possible, but you actually have to suspect your client and server ahead of time, and in practical terms you have to have control and visibility over a huge amount of network space.

The Tor FAQ may be a good place to have a look, but essentially the attack is possible given:

A bad first of three servers can see encrypted Tor traffic coming from your computer. It still doesn't know who you are and what you are doing over Tor.


A bad third of three servers can see the traffic you sent into Tor. It won't know who sent this traffic.

Someone would have to control at least three servers to make the match, and in practice would have to control many, many more as there's no way of determining which three servers any given connection is going to use in a network circuit.

Now scale this up; you want to just identify popular .onion sites, but you're seeing traffic coming in from IPs and out to IPs. You have no idea, none, which traffic is 'response' traffic, and which is 'request' traffic, you have no idea if those IPs are simply relays that happen to be chosen a few times - it's very possible in this scenario that you never see the IP of any popular .onion sites. Additionally, Tor circuits are built to resist this sort of attack.

Specifically if you're watching all traffic in and out, and you identify as being popular - you don't know if that's an endpoint, or a router, a server/client uploading or downloading something. All you know is that it's Tor traffic. Tor is set up so that that's not really interesting information - the fact that you're running Tor isn't a secret (and as you noted, they publish the list of exit nodes for blacklisting purposes, but all non-bridge nodes are listed in the regularly published relay descriptors).

It's a bit different if you already have some suspects, timing attacks can work in this case - but at the end of the day, you can likely only show that two machines are communicating, not what they're communicating about, and you don't definitively know they're not just a router in the transaction.

Finally, if the service you're trying to identify is a Hidden Service all bets are likely off - they're designed to distribute the sort of traffic you're looking for on one link by deliberately adding a number of pre-trusted routers into the equation, which would negate any knowledge you had of the network.

  • Thanks very much for this detailed answer. I didn't really think about the response/requests and uploads/download side of things which would skew the collecting of IPs. Very much appreciated!
    – user20837
    Feb 15, 2013 at 23:31
  • Added a bit on Hidden Services - I had assumed you meant 'except where', but I have no idea how I read that into the question :)
    – Bob Watson
    Feb 15, 2013 at 23:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .