0

As part of some computer forensics work, I have been asked to look at network traces (showing IP addresses and port numbers) from several years ago, to see if someone was using Tor.

I have heard that I can use services like CollecTor and Onionoo to check if a certain IP address is currently an entry node and/or an exit node, but that does not help if those nodes are no longer in use.

From reading Tor documentation, it sounds like Tor nodes often use ports 80 and 443 in order to pass through firewalls, but seeing those as destination ports does not tell me if the user is trying to connect to Tor or just connecting to a Web server.

How about looking for ports 80 or 443 as source ports? The OS would never hand out a port number that low unless the program asked for it specifically, right? And ordinarily only the Web server program would ask for 80 or 443, and then only as a potential well-known destination port for someone else to use, not as a source port.

Or am I going about this all wrong?

Improve this question

2 Answers 2

Reset to default
1

When https://exonerator.torproject.org/ is working, it will tell you whether an IP address was a relay for a given date.

Besides that, you can find old consensuses and search yourself https://metrics.torproject.org/collector/archive/relay-descriptors/server-descriptors/

Improve this answer
1
  • 1
    By design this does not know about bridges. The ISP may still identify bridge traffic through traffic shape analysis, but this is expensive and may incorrectly classify traffic.
    – cypherfox
    Commented Mar 11, 2018 at 9:31
0

Or am I going about this all wrong?

Yup.

Source or destination port will not tell you anything about what the user was using.

You'd want to check the IP and port compared against an archive of the Tor consensus at that time, to see if any of them match known ORPorts.

However the user may have been using bridges, in which case you will not be able to tell from just an IP and port used.

You can retrieve the IPs and Ports for relays in historic consensus from the Collector Microdesc Archive.

Improve this answer
3
  • Is there such a publicly-available archive of Tor nodes as of a given time in the past? How can I access it?
    – Mike Ciaraldi
    Commented Mar 10, 2018 at 13:19
  • updated my answer to include a link to the archives.
    – cacahuatl
    Commented Mar 10, 2018 at 22:14
  • Thanks to everyone who answered. I am now able to successfully use exonerator to check IP addresses to see if they were Tor nodes.
    – Mike Ciaraldi
    Commented Mar 11, 2018 at 23:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .