0

I have a Tor Relay running at home on a a small Raspberry Pi (pushing 50Mbit/s) with an ExitPolicy reject :.

Tor Atlas confirms that the Relay is not an Exit Node (https://atlas.torproject.org/#details/72092C6311D890076B0FDE9AA04D05E83DC80A7B)

But the strange part is, why does my router identify traffic which it should not? (see pic)

DPI on EdgeOS

My torrc:

Log notice file /var/log/tor/notices.log
ORPort 9001
DirPort 9030
Exitpolicy reject *:*
Nickname kurwa
ContactInfo email-address
RelayBandwidthRate 3000 KB  # Throttle traffic to 100KB/s (800Kbps)
RelayBandwidthBurst 4000 KB # But allow bursts up to 200KB/s (1600Kbps)
Improve this question

1 Answer 1

Reset to default
2

Your router appears to be performing an incredibly naive form of traffic identification.

I'd guess that it's simply looking at the content of /etc/services or equivalent and matching a service to it's default port and assuming that all traffic it observes on that port is that service.

It's totally valid for Tor relays to run on any port and it's likely identifying, for example, Tor traffic on port 22 as SSH traffic or Tor traffic on 3306 as MySQL traffic.

Improve this answer
3
  • I really do not think that this is the case. EdgeOS is inspectning the packets from the it can identify the services. I thought so too but I did some tests and it could correctly identify the services even if the defaults ports was changed. However, why is the Relay generation traffic over thoose ports? I have only opened up 9001 and 9030 and it is not an Exit Node - even if you explanation could be valid it does not explain why the relay is generating traffic over thoose ports.
    – Orphans
    Commented Apr 6, 2017 at 13:18
  • 1
    Non-exit relays will connect to other relays using any port. The ExitPolicy, as its name suggest, only limits what IPs and ports that can be connected to when exiting. I too doubt that any packages inspection is done: a) some protocols listed are very hard to distinguish (in particular anything using TLS/SSL), b) doing so is quite resource intensive, c) it isn't exactly easy to implement and d) I doubt that anyone interested in package inspection will use EdgeOS (I'm sure there is specialized software/hardware for it)
    – Peter Gerber
    Commented Apr 6, 2017 at 19:38
  • @P.Gerber Thanks for the explanation. I have talked to UBNT and they still claim that their product identifies services via Deep Packet Inspection and not just the ports the communication is. But I did some test again and send mysql trafik over port 80 - and it identified as HTTP! So the problem here in EdgeOS and not Tor. Regarding specialized hardware/software for DPI, check out Palo Alto Networks firewalls - they are pretty neat (using them myself and work and they have REAL DPI)
    – Orphans
    Commented Apr 7, 2017 at 5:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .