Tor traffic capture

Question

How possible is it to capture and then analyse Tor traffic to/from your local machine (i.e., using wireshark)? I'm interested in more than just website requests / responses; I want to capture all traffic, including things such as circuit creation cells and descriptor publishing.

My attempts to do this so far have failed because I wasn't able to decrypt captured traffic. It should be possible to decrypt the traffic, however, I need a copy of all public/private keypairs used for all encryption on the local machine.

Alternatively is there a good website where these sorts of captures or examples are available for download?

Answer 1

Once your client gets necessary information about the Tor network from directory servers, it routes all traffic through the entry guards (currently three) that it has chosen. That traffic is multiply encrypted, as explained here. The outermost encryption layer uses the public key of the entry guard.

In order to decrypt that traffic, you would need to know the entry guard's private key. But you don't, and so you can't decrypt the traffic.