If an ISP was performing deep packet inspection on a server's traffic, would they be able to tell the difference between a hidden service and a relay?
To clarify, I'm talking about a "middle relay" - not a bridge or an exit node.
Tor Stack Exchange is a question and answer site for researchers, developers, and users of Tor. It only takes a minute to sign up.Sign up to join this community
I assume you are talking about a webserver which an onion service configured and acts as a Tor relay. The Tor relay can do three things:
The onion service makes every time a connection to a Tor IP address and sends traffic back and forth. Especially it uses its own guard node to send and receive traffic.
So depending on the specific traffic pattern and setup of the relay I guess from the above knowledge it might be possible for an ISP to distinguish between relay traffic and onion service traffic.