I'm trying to understand at what layer does the SOCKS proxy receive. For example, if I visit a website and make a HTTP get to the web server it is passed through via SOCKS to make the request.

  1. At the SOCKS server or Onion Proxy, after the circuit creation, key exchanges, etc., what does it receive and how does Tor package/wrap the HTTP get request into its cell. I ask this because I created a SOCKS server and read the buffer and it outputted the application data (host, user-agent), so does Tor split those (application byte stream) into 512 bytes cells and add the respective cell headers?

  2. Then what about the TCP handshake (SYN, SYN-ACK, ACK) or TCP data transfer. Do those need to be packaged into cells as well? I ask this because does the client connect the TCP handshake or does the exit node handle that? I never quite understood the initiation process. If it's the first, then are the syn, syn-ack, ack packets sent via onion routing individually or if its the latter then does the exit node just pass the data down the stream, so that there is two connections: client onion routing to exit and exit to web server?

  3. Relating to questioon 1, how does the web server receive and interpret those cells? I'm assuming the exit node's SOCKS proxy server handling the incoming (?) and outgoing traffic somehow strips the cell data. But not really sure on the details.

Apologies for the lengthy questioning, any insights would be appreciated.

enter image description here

1 Answer 1


The SOCKS proxy operates on the application layer. Therefore the answers to your questions are:

  1. The SOCKS proxy receives whatever you send to it via the TCP connection that is built up to the SOCKS proxy. The data is split into 512 byte sized cells and sent to the onion routers.
  2. TCP-specific packages are not being transferred via Tor. The exit node creates a TCP connection to the server and sends it whatever data you sent to the SOCKS proxy.
  3. The web server doesn't receive cells. The exit node receives the cells and forwards the included data via the TCP connection to the server.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .