2

I am comparing two traffic instances using Wireshark: one using Tor and the other not using Tor. In both instances, the user requests the HTML document of a web page. In both instances I first filtered out the ACK packets, then I placed both traffic captures side by side and compared them.

No Tor vs. Tor

In the non-Tor capture file on the left, after an initial handshake protocol, there is an HTML request, followed by a continuous retrieval of the HTML document until complete.

In the Tor capture file on the right, although encrypted I can see a similar pattern of a continuous flow of packets from the entry relay to the user. However, there are times when the user sends a packet to the exit relay, which does not appear in the non-Tor capture file. An example of this is highlighted in the red border.

I did some reading of my own, specifically a research paper called Improved Website Fingerprinting on Tor, by Tao Wang and Ian Goldberg, where I read about SENDME cells, which are sent from the user to the Tor network every 50 cells as a form of flow control. However, looking at the capture files, the intervals in which I see extra packets is not always constant, so I’m assuming there may be other background traffic along with the SENDME cells.

Irregularly sent packets

What are these packets sent from my Tor client at irregular intervals during a download?

| improve this question | |
  • Why do you believe the packets are from or related to Tor and not some other process? – cacahuatl Apr 5 '17 at 3:39
  • What else is in the packet? Is it part of Tor's TCP stream? You're looking at it from too far back... – cacahuatl Apr 5 '17 at 3:50
  • @canonizingironize, I apologize for not specifying. I used tcpdump to look at the traffic, specifically on port 5000 which is the default onion router port, so it must be from Tor. – takuya_f Apr 5 '17 at 4:07
  • 1
    Tor is doing more than just a single circuit though, it keeps multiple circuits open at once. I'd recommend you approach it by looking at Tor with debugging logs to get a better idea of what Tor is doing at the time the packets are sent, if no one is able to give you an authoritative answer here. – cacahuatl Apr 5 '17 at 4:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.