If an ISP was performing deep packet inspection on a server's traffic, would they be able to tell the difference between a hidden service and a relay?

To clarify, I'm talking about a "middle relay" - not a bridge or an exit node.


I assume you are talking about a webserver which an onion service configured and acts as a Tor relay. The Tor relay can do three things:

  • takes connections from non-Tor IP addresses and forwards them into the Tor network (guard node)
  • take connections from Tor IP addresses and forward them to other Tor IP addresses
  • take connections from Tor IP addresses and forward them to non-Tor IP addresses (exit node)

The onion service makes every time a connection to a Tor IP address and sends traffic back and forth. Especially it uses its own guard node to send and receive traffic.

So depending on the specific traffic pattern and setup of the relay I guess from the above knowledge it might be possible for an ISP to distinguish between relay traffic and onion service traffic.

| improve this answer | |
  • Clarified question. – John Dope Aug 10 '17 at 2:48
  • 1
    A non-exit and non-guard will still make connections to a large number of Tor relays but an onion service will, as Jens pointed out, only really connect to it's chosen guard. It would look a lot more like a client than a relay. – cacahuatl Aug 10 '17 at 20:30

NO, it's impossible for ISP. All they will see/look-at will be just a stream of an encrypted traffic

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.