Want to help moderate this community? We need more candidates in the ongoing election!
3 Edit TOR/Tor
source | link

Yes, CapLoader can identify the TORTor version of SSL, as we've demonstrated here: http://netresec.com/?b=13400BE

The "TOR Packet Analysis" report (linked by @Aurora) simply classifies traffic to TCP 9001 as TORTor. However, TORTor traffic usually runs on several other ports, like TCP 443. CapLoader, on the other hand, does not rely on the TCP port number for the protocol identification.

We'd be happy to run a packet capture file through the commercial full version of CapLoader and share the output with you, if you can provide us with a PCAP file containing TORTor traffic.

Additionally, if you'd like to share your PCAP publicly online (for example by posting it to CloudShark) then we'd be happy to publicly share the CapLoader output in this StackExchange thread.

Yes, CapLoader can identify the TOR version of SSL, as we've demonstrated here: http://netresec.com/?b=13400BE

The "TOR Packet Analysis" report (linked by @Aurora) simply classifies traffic to TCP 9001 as TOR. However, TOR traffic usually runs on several other ports, like TCP 443. CapLoader, on the other hand, does not rely on the TCP port number for the protocol identification.

We'd be happy to run a packet capture file through the commercial full version of CapLoader and share the output with you, if you can provide us with a PCAP file containing TOR traffic.

Additionally, if you'd like to share your PCAP publicly online (for example by posting it to CloudShark) then we'd be happy to publicly share the CapLoader output in this StackExchange thread.

Yes, CapLoader can identify the Tor version of SSL, as we've demonstrated here: http://netresec.com/?b=13400BE

The "TOR Packet Analysis" report (linked by @Aurora) simply classifies traffic to TCP 9001 as Tor. However, Tor traffic usually runs on several other ports, like TCP 443. CapLoader, on the other hand, does not rely on the TCP port number for the protocol identification.

We'd be happy to run a packet capture file through the commercial full version of CapLoader and share the output with you, if you can provide us with a PCAP file containing Tor traffic.

Additionally, if you'd like to share your PCAP publicly online (for example by posting it to CloudShark) then we'd be happy to publicly share the CapLoader output in this StackExchange thread.

2 Added info about the "TOR Packet Analysis" report and port numbers
source | link

Yes, CapLoader can identify the TOR version of SSL, as we've demonstrated here: http://netresec.com/?b=13400BE

The "TOR Packet Analysis" report (linked by @Aurora) simply classifies traffic to TCP 9001 as TOR. However, TOR traffic usually runs on several other ports, like TCP 443. CapLoader, on the other hand, does not rely on the TCP port number for the protocol identification.

We'd be happy to run a packet capture file through the commercial full version of CapLoader and share the output with you, if you can provide us with a PCAP file containing TOR traffic.

Additionally, if you'd like to share your PCAP publicly online (for example by posting it to CloudShark) then we'd be happy to publicly share the CapLoader output in this StackExchange thread.

Yes, CapLoader can identify the TOR version of SSL, as we've demonstrated here: http://netresec.com/?b=13400BE

We'd be happy to run a packet capture file through the commercial full version of CapLoader and share the output with you, if you can provide us with a PCAP file containing TOR traffic.

Additionally, if you'd like to share your PCAP publicly online (for example by posting it to CloudShark) then we'd be happy to publicly share the CapLoader output in this StackExchange thread.

Yes, CapLoader can identify the TOR version of SSL, as we've demonstrated here: http://netresec.com/?b=13400BE

The "TOR Packet Analysis" report (linked by @Aurora) simply classifies traffic to TCP 9001 as TOR. However, TOR traffic usually runs on several other ports, like TCP 443. CapLoader, on the other hand, does not rely on the TCP port number for the protocol identification.

We'd be happy to run a packet capture file through the commercial full version of CapLoader and share the output with you, if you can provide us with a PCAP file containing TOR traffic.

Additionally, if you'd like to share your PCAP publicly online (for example by posting it to CloudShark) then we'd be happy to publicly share the CapLoader output in this StackExchange thread.

1
source | link

Yes, CapLoader can identify the TOR version of SSL, as we've demonstrated here: http://netresec.com/?b=13400BE

We'd be happy to run a packet capture file through the commercial full version of CapLoader and share the output with you, if you can provide us with a PCAP file containing TOR traffic.

Additionally, if you'd like to share your PCAP publicly online (for example by posting it to CloudShark) then we'd be happy to publicly share the CapLoader output in this StackExchange thread.