If an ISP was performing deep packet inspection on a server's traffic, would they be able to tell the difference between a hidden service and a relay?
To clarify, I'm talking about a "middle relay" - not a bridge or an exit node.
2 Answers
I assume you are talking about a webserver which an onion service configured and acts as a Tor relay. The Tor relay can do three things:
- takes connections from non-Tor IP addresses and forwards them into the Tor network (guard node)
- take connections from Tor IP addresses and forward them to other Tor IP addresses
- take connections from Tor IP addresses and forward them to non-Tor IP addresses (exit node)
The onion service makes every time a connection to a Tor IP address and sends traffic back and forth. Especially it uses its own guard node to send and receive traffic.
So depending on the specific traffic pattern and setup of the relay I guess from the above knowledge it might be possible for an ISP to distinguish between relay traffic and onion service traffic.
answered Aug 9, 2017 at 13:31
-
-
1A non-exit and non-guard will still make connections to a large number of Tor relays but an onion service will, as Jens pointed out, only really connect to it's chosen guard. It would look a lot more like a client than a relay. Commented Aug 10, 2017 at 20:30
NO, it's impossible for ISP. All they will see/look-at will be just a stream of an encrypted traffic
answered Oct 9, 2017 at 3:52
