I research tor, and have some question bout it.

  1. Can relay node know which entry node transferred certain traffic? Or can't, cause tor uses ephemeral encryption and after circuit ends, keys removed, in case relay-node doesn't sniff traffic, and define, what entry node transferred traffic, impossible?

  2. Does relay node save date, what entry nodes transferred certain traffic and to what exit nodes in certain time, does relay-node logs connections? And same about entry nodes. If all 3 tor nods in circuit sniff traffic, might it find sender of certain traffic in this case?

  3. Are there some possibilities to log and keep traffic on relay and entry nodes? Software, etc?

1 Answer 1


Each relay only knows the two adjacent clients/servers on a circuit. So the guard sees the client and middle, but not the exit. The middle sees the guard and exit, but not the client. The exit sees the middle and the destination server. A single relay should never be able to link the client to the destination server.

The tor software does not log connections or traffic, but it is possible for a malicious relay operator to modify or monitor tor and log this information. This is why Tor circuits use three hops, so that it's unlikely that all three relays will be owned by the same operator and logging connections/traffic. If all three relays were malicious and owned by the same person, then theoretically yes they could know which websites the client accessed.

  • If by chance people that operated guard, relay, & exit nodes all turned out to log, could a government organization just follow the chain up from the exit node all the way to the client?
    – Max
    Commented Feb 21, 2021 at 4:53
  • @Max: Yes, if this government runs all three relays in a user's circuit and was logging their relays' states, they know the end-to-end path of the data and could determine what sites the user visited on that circuit.
    – Steve
    Commented Feb 21, 2021 at 8:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .