How does the ISP know if Tor is used

Question

How does the ISP know if i m using Tor? I read many articles about it but none of them wrote HOW... If i use Tor on 80 and 443 ports, how can ISP know it s Tor? Do ISPs have a database about Tor entry nodes' IPs?

Answer 1

There are a few ways that an ISP could learn that you're using Tor. Like you said, an ISP could easily download a list of all Tor relays and check if you're connecting to an address (ip/port) of any relay. This is the most common (and easiest) way of censoring the Tor network.

Some users run unlisted bridge relays so that censors (or in this case the ISP) don't learn the IP addresses of these relays. In this case the ISP can analyze the encrypted traffic itself and the timing to guess if it's Tor traffic. For this reason bridge relays use traffic obfuscation like obfs4 to make the traffic look different from regular Tor traffic.

Answer 2

How does the ISP know if i m using Tor? I read many articles about it but none of them wrote HOW... If i use Tor on 80 and 443 ports, how can ISP know it s Tor?

In short DPI or Deep packet inspection. Packets of ssh differs from https packets. Packets of icmp-pings has nothing similar with dns-53 udp packets... etcetera..

Do ISPs have a database about Tor entry nodes' IPs?

Actually, you have it too, and mostly every tor's client shall, because it is how p2p-networks are working...

You could see pretty printed version on this site: https://torstatus.rueckgr.at/

Or you could type in your terminal

# cat /var/lib/tor/cached-descriptors| less

@downloaded-at 2021-01-14 09:27:49
@source "216.252.162.21"
router fkrelayhandlefk 167.86.104.147 9001 0 0
identity-ed25519
-----BEGIN ED25519 CERT-----
........
-----END ED25519 CERT-----
master-key-ed25519 .......
platform Tor 0.4.2.7 on Linux
proto Cons=1-2 Desc=1-2 DirCache=1-2 HSDir=1-2 HSIntro=3-5 HSRend=1-2 Link=1-5 LinkAuth=1,3 Microdesc=1-2 Relay=1-2 Padding=2 FlowCtrl=1
published 2021-01-14 08:35:15
fingerprint ....
uptime 143742
bandwidth 12779520 12779520 23467927
extra-info-digest ....    onion-key
-----BEGIN RSA PUBLIC KEY-----
.....
-----END RSA PUBLIC KEY-----

See, all ip-addresses are here, router fkrelayhandlefk 167.86.104.147 9001 0 0.

# cat /var/lib/tor/cached-descriptors| grep ^router | grep -v router-sig | wc -l
7214

Even my cache contains 7k routers... 7k different ip-addresses, part of its are exits, part are guards, part are middles...

To prevent such attacks, when your ISP simply downloading all ip-addresses and block your communication with em, there are Tor-Bridges.

In short, bridges are not listed in any p2p public resources, you are getting its ip-addresses by e-mail or anyhow else. There is no easy way to find all bridges and blacklist all of its.

From the side of DPI - there is obfs4 - it is a technology which is trying to mimic to ordinary https-traffic. While https is ssl based, there is no another easy way to crack https-packets and that is why it is hard to Deep Packet Inspect its.

So, you should use bridge and obfs4-transport to be sure that your ISP know nothing about your tor-network-surfing.