I am not an expert in Wireshark but I was looking at some packets through Wireshark. I noticed that when using a relay that the connection to the directory authority the first few TCP packets such as the SYN, SYN-AKN and the AKN are occurring before the TLS hand shack
Q 1 So I am assuming that this is unencrypted data. Is this correct?
Q 2 Are the first three packets I see (SYN, SYN-ACK and the ACK) between the tor client and the tor relay and bridge and all packet there after encrypted when using a bridge and a relay?
Q 3 If the keys are public keys that are used to connect to the tor network would the keys be know by the attacker as well ?
Q 4 Does this mean the attacker can intercept the connection?