After I read this link, I tried to understand how they manage detect Tor traffic

The most understandable source for me was this paper

He is saying Tor traffic can be detected by port, cipher suite length , extensions and validity duration of certificate can be use. I tried to implement that and I saw Tor corrected all their weaknesses which are pointed in the document.

According to my experiences it is not possible to detect Tor users in network, but how are companies able to detect Tor? I am extremely curious. Does Tor have any TLS abnormalities?

  • 2
    Our company uses what it calls 'Next Gen Firewalls' which do DPI and 'know' the signature of TOR traffic as well as maintaining a list of TOR end-points. As a result, i've never been able to get TOR traffic through it no matter what options i use. – NULLZ May 22 '13 at 8:12
  • @D3C4FF Even with obfsproxy? – Adi May 22 '13 at 8:49
  • @Adnan obfsproxy = bridges? Then yes. That gets blocked as well. – NULLZ May 22 '13 at 9:04
  • @D3C4FF do you have any idea have to get list f TOR end-points – Kadir Erdem Demir Jun 18 '13 at 8:09
  • @KadirErdemDemir what? I don't understand. – NULLZ Jun 18 '13 at 9:22

Blocking Tor at a network level is difficult, and anyone trying to do so will face a constant battle with the Tor developers. It's similar to the red queen effect between malware developers and AV researchers; every time an improved technique comes out to block Tor the developers will change the way it works.

I see Tor use as more of an endpoint control issue, and a user behavior issue rather than a network blocking issue. If you want to stop Tor then prevent it from being installed, and let users know the penalties for using it (providing you have an applicable AUP which says so).

| improve this answer | |
  • othertopic....why blocking entry point IPs of Tor does not work? – again Jul 13 '18 at 11:08
  • You can't differentiate ToR traffic from regular web traffic @again. – GdD Jul 13 '18 at 11:11
  • but in packet there is destination ip of entry node. Is possible to collect all entry node IPs? – again Jul 13 '18 at 11:14
  • No, they change often and there's no definitive list @again. – GdD Jul 13 '18 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.