I am wondering what an entry node knows about its users. I know they do not know where you are sending data or what the data is because of onion routing and encryption respectively. But, does TOR take any steps to mask how large of a message a user is sending or how many packets a user is sending? If an entry node does know how many packets and of what relative size a user is sending, would it be possible for such a node to know what protocols are being spoken?
Entry nodes generally know your IP address, the IP address of the next hop and and they can see traffic patterns. Tor sends so called cells, they have all the same size and are padded if necessary. This helps to avoid traffic correlation and figuring out the exact amount of traffic sent. This provides some protection but a sophisticated adversary might still be able to guess what protocols or services your using. I guess it really depends on your traffic. Perhaps you should have a look the traffic and see if there is any pattern you can make out (e.g. traffic spikes in certain intervals, large downloads with of a certain size, etc.).
The question separates in 2 patrs:
- If the code is unmodified for tracking - just your IP address. And that's it. Yes, using Tor control protocol, you can collect and log them, no full logs are possible via
- If code was tailored - well, it depends on the tailoring techniques. It's likely to have a middle node IP address as well, but - in case of standard 3-hop long chain - it can not track the exit fully. But if you're using HTTPS and proper security on your endpoint - there's no harm possible to cause just by injecting a malicious entry node. Anyway, it can NOT see what you're doing, what DNS and HTTP+HTTPS requests you're making and so on.