If I sniff packets or DNS requests using Wireshark, OpenDNS, or a similar tool, will I only see (via wireshark) that a TOR user has connected to a TOR entry node, or will I be able at all to determine which website is ultimately being requested on the part of the user. Additionally, isn't it true that TOR does not use DNS resolution, and therefore tools like OpenDNS could not even detect TOR traffic?

I am currently under the impression that Wireshark can only detect that one is connecting to TOR, and not what data is actually being accessed/transacted on the web.

2 Answers 2


If you are using Tor properly, DNS will not leak and they will be able to see you're connecting to Tor, but not where you're connecting to over Tor. Clearly if someone upstream was able to sniff DNS to discover a Tor users intended destination that would be a huge defeat.

That said, it is known to happen. Many applications fail to use proxy settings properly. They might, for example perform a DNS resolve locally then ask Tor to connect to an IP directly, this not only breaks their ability to utilise onion services, it also constitutes a leak of DNS. Intelligence agencies were looking for such leaks since at least 2011.

Tor Browser, Tor Messenger and other applications that are well designed for use with Tor will take steps to ensure that the proxy settings are employed at all times a property the Tor Browser Design Specification calls Proxy Obedience

In such cases, Tor can provide a DNSPort which is a minimal DNS server (it handles on A, AAAA and PTR records) run by the tor daemon which will allow you to perform basic DNS resolve over Tor. Note that the Windows resolving proceedure is complex and changes frequently and would require further steps to avoid leaks.

So, if the application does not properly utilise SOCKS5 with remote hostname lookup or SOCKS4a then it's possible that some upstream observer would see DNS requests.

Anyone with network visibility of the connection between the application using Tor and the Tor daemon will be able to see all the Tor traffic, before it was protected. Anyone upstream, (between the Tor daemon and it's Guard or Bridge) would only see that they were using Tor, assuming it was using Tor properly (see: Proxy Obedience).


That's correct - you can see just that someone is connected to Tor network, no other data is leaked out - it's encapsulated into Tor traffic. OpenDNS or whatever traffic inspection tool will see that an exit node makes a DNS queries and after that it makes an outgoing connections to the hosts resolved. It's a pretty obvious network behaviour pattern, so tor usage is not detected here too.

In case of data leaks on client side - well, you'll see something in most of the cases, but it's an incorrect setup situation and what you will be able to see - if you will see it at all in Wireshark - is highly dependent on the configuration/setup mistake on the client side.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .