As part of some computer forensics work, I have been asked to look at network traces (showing IP addresses and port numbers) from several years ago, to see if someone was using Tor.
I have heard that I can use services like CollecTor and Onionoo to check if a certain IP address is currently an entry node and/or an exit node, but that does not help if those nodes are no longer in use.
From reading Tor documentation, it sounds like Tor nodes often use ports 80 and 443 in order to pass through firewalls, but seeing those as destination ports does not tell me if the user is trying to connect to Tor or just connecting to a Web server.
How about looking for ports 80 or 443 as source ports? The OS would never hand out a port number that low unless the program asked for it specifically, right? And ordinarily only the Web server program would ask for 80 or 443, and then only as a potential well-known destination port for someone else to use, not as a source port.
Or am I going about this all wrong?