Does the exit node see which second node transmitted the given traffic, and do other nodes see the same thing? (Does node see the previous node that sent this traffic?) And do nodes see any nodes of the chain, except previous and/or next using in the transmission of this traffic (for example, does exit node see which first node sent this traffic, etc) and if yes, which nodes see and what?
3 Answers
Each link in the "chain" of nodes that make up a circuit can see who the previous and next links are, but (absent misconfiguration or attack) no more than that. So the exit node know who sent it the cell, but it doesn't know who the entry node was. The middle node knows who the entry and exit nodes are, but doesn't know who connected to the entry node (the user) nor who the exit node is talking to (the destination).
Does the exit node see which second node transmitted the given traffic
Yes. It also knows where the traffic is going (e.g. which server the user wants to talk to). Generally speaking, every node in the network knows where it's traffic is coming from and where it is going. But as long as the nodes in the chain don't cooperate, it can't know anything beyond that.
The reason
Tor is an overlay network that sits on the public internet. On the internet, hosts communicate by sending packets to each other. All of them carry the sender and destination address (two IP addresses). The sender address is necessary so that the destination knows where to send the reply to, and the destination address is obviously necessary so the routers on the internet know where to send the packet to.
So a Tor node, which sits on a public internet host, can always figure out where traffic it gets came from by looking at the sender (source) IP address of the IP packets it gets. Conceptually, this happens at the IP layer of the TCP/IP reference model, while Tor sits at the application layer (two layers up), so it can't do anything about this.
Tor's reason of existence is to make it possible to hide the source IP addresses of a communication flow's packets, which isn't something the IP and TCP/IP protocols were designed to do. Since Tor uses these protocols, it's nodes can't hide from each other.
The exit node sees which relay node said traffic is coming from, but it doesn't know the guard node or end-user's identity. The relay node sees both the guard and relay node, but doesn't see the end-user or the destination of the traffic. The guard nodes sees the end-user and the relay node but doesn't know the exit node or the destination of the traffic.
Essentially by limiting who knows what, we're able to create a connection in which no one has enough information to properly identify or attack a specific user. Surely there are different ideas as to how Tor can be attacked, and some of these attacks can work quite well. But generally speaking, if a user is using Tor properly with good OpSec practices, they're probably going to be "safe enough".
