I am comparing two traffic instances using Wireshark: one using Tor and the other not using Tor. In both instances, the user requests the HTML document of a web page. In both instances I first filtered out the ACK packets, then I placed both traffic captures side by side and compared them.
In the non-Tor capture file on the left, after an initial handshake protocol, there is an HTML request, followed by a continuous retrieval of the HTML document until complete.
In the Tor capture file on the right, although encrypted I can see a similar pattern of a continuous flow of packets from the entry relay to the user. However, there are times when the user sends a packet to the exit relay, which does not appear in the non-Tor capture file. An example of this is highlighted in the red border.
I did some reading of my own, specifically a research paper called Improved Website Fingerprinting on Tor, by Tao Wang and Ian Goldberg, where I read about SENDME cells, which are sent from the user to the Tor network every 50 cells as a form of flow control. However, looking at the capture files, the intervals in which I see extra packets is not always constant, so I’m assuming there may be other background traffic along with the SENDME cells.
What are these packets sent from my Tor client at irregular intervals during a download?
