Great question. I'd like to start out by explaining the concept of onion routing so satisfy your comment that the concepts are unclear to you, then discuss some key areas that should answer your question about routing tables. Onion routing is a technique for anonymous communication over the unsecure internet by using PKI encryption between each pseudo-random onion router that belongs to an onion routing group, such as the Tor network. The goal of onion routing is to provide anonymity for the SOURCE IP ADDRESS as well as possibly the HIDDEN SERVICES it uses. Let's rise up from the details and discuss an example. Let's say you're at home on your computer and you open your favorite browser and go to https://www.anywebsite.com. The people at that website can see which source ip address (YOUR ip address) hit their server. Now let's say for ANY reason at all you still want to get to that website, but you DO NOT want them to know YOUR ip address that you originated from at home. Here's how you do it. Assuming you have already downloaded/installed your onion routing software, you open your browser and go to that website. From there, the onion routing software designs (NOT CREATES!) a "circuit of relays" that will get you from your home to the destination. Here's something to keep in mind. Normal internet routing communications are designed to provide you with the shortest Autonomous System to the destination. Onion routing's goal is anonymity. Here's how it works. Your onion routing software looks in it's constantly-updated table of relays/bridges to determine which onion routers (it needs a MINIMUM of three) it will use for THIS particular communication. Your computer then sends its traffic to the entry node (aka The first onion router). That entry node creates an encrypted https session to the second onion router (aka, the intermediary), then sends it to the intermediary. (See torproject.org for exact encryption methods) The intermediary creates an encrypted https session to the next onion router (let's assume that in this example, the next one is the EXIT NODE - aka last onion router in the circuit) then sends the data there. The exit node at this point sends the data to that website.
SO WHAT WAS ACHIEVED?? Nobody in the entire circuit KNOWS THE PATH of the entire circuit because they only know what came directly before it and what comes directly after it! The entry node (first onion router) only knows the IP of the originating computer and the IP of the next onion router. The intermediary node only knows the IP of the originating entry node and the IP of the next onion router (in this case, the EXIT NODE). The exit node only knows the IP of the intermediary node and the destination IP address. This all succeeds because the information is encrypted/encapsulated in "layers", such as the layers of an onion. Hence, onion routing.
Ok, now onto your question. Your question was, "isn't it an issue if we look at the routing table of a tor node to get the previous/next one of a specific client's circuit and then watch the routing table of the previous next router ... till we reach the client or the server ?". Answer: It is not an issue because the "circuit" is pseudo random and changed frequently, so it's mathematically not possible to guess which onion routers will be in play for the next circuit without somehow tampering with the process. Once this circuit is complete, your next circuit could be a set of any other pseudo-random onion routers. BUT!! For argument's sake, let's go ahead and say the circuit never changed. Realistically, what would have to be done is this. You watch the traffic leaving your computer and notice where the traffic is going and write down that IP address. You then need to discover where that IP address is physically in the world, then contact that person/business so you can go inspect their onion router. Let's say they agree and tell you the onion router is in India - come take a look. You go there, or remote to it, and tell yourself, "Ok, I know that if I do a SHOW IP ROUTE I can see the route table, but this is a Windows machine" (or Linux, I suppose - but Windows in this example). Are you sunk? Not if you got to that Windows machine in time before the netstat table entry expires. So you drop to a command prompt and to a NETSTAT -a and a list of "TCP connections" (not routes) appear and show what you're connected to under the Foreign Address column. So now that you're staring at a screen filled with TCP connections (assuming you didn't send traffic using UDP, because if you did then they won't list here because UDP is connectionless) you realize that you have no idea which one of these connections goes to the "intermediary node" because that information was encrypted and encapsulated (See torproject.org for details on that). So are you sunk? Remember, an onion router only knows where it DIRECTLY came from, and where it's DIRECTLY going. The entry node knows the originating IP, and in the tenth of a second or less it knew where the next onion router was. But because it processes SO MANY requests like this and they expire quickly, there's too many to choose from and now we're talking exponential mathematics to take all of the results and do the same thing on those. But for argument's sake, let's say that nobody was using the entire onion-routing network during that time except you and the netstat table only showed ONE connection - and that connection was to your next onion router! Ok, contact them, fly there or remote onto it if you can speak their language (before the netstat table expires) and do the same thing until you get to the exit node. On the exit node, you find the IP of the destination. Did you finally do it!!?? Well, that depends on what your goal was. If your goal was to know the source IP, the path it took for THAT connection, and know the destination IP, then given all of these circumstances, you have found that information for that one connection stream. But if your goal was to KNOW what conversation took place, are you sunk? Let's go a step further and say that a packet capture was running on all of these onion routers while this communication took place and you now have access to all of them!!! Now what do you have!!?? You have all of the encrypted traffic that went between the originating pc and that website because all of that was encrypted on the application layer when they typed in HTTPS. You are now the proud owner of multiple packet captures filled with PKI encrypted data. It's at this point, you're sunk.
I hope this information was useful!
