I have created a private Tor network for testing purposes, as well as to verify the fundamental operation of Onion Routing. I am utilizing Wireshark to capture the data flow between relays across the network, however when I examined these captures more closely I discovered that they utilized RSL / IPA protocols in addition to the TCP protocols I was expecting. Does anyone have any input as to what the purpose of these protocols are? An example of my Wireshark capture containing the RSL / IPA protocols can be seen below -

Wireshark capture of RSL / IPA protocols while testing Tor network connectivity

Initially the RSL packets are more diverse as seen by the highlighted packet in Frame 60, as well as Frames 62, 64, 65, 66, 67, and 69 - however this changes to just "SACCH FILLing", seen in Frames 71, and 72 throughout the rest of the capture. My initial thoughts are that the SACCH FILLing RSL packets are simply to check and make sure that the relay is still active OR they are improperly displayed packets in Wireshark.

The network diagram for my private Tor network can be seen below -

Network Diagram of my private Tor network


Tor doesn't use those protocols.

I think Wireshark is just mistakenly assuming traffic to/from port 5000 is RSL.


  • Thank you for the assistance in discovering this issue. I have modified the configuration in Wireshark to not assume that anything on Port 5000 is RSL/IPA and it now appropriately displays theTCP packets. – HobarGJ Nov 29 '17 at 17:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.