How possible is it to capture and then analyse Tor traffic to/from your local machine (i.e., using wireshark)? I'm interested in more than just website requests / responses; I want to capture all traffic, including things such as circuit creation cells and descriptor publishing.

My attempts to do this so far have failed because I wasn't able to decrypt captured traffic. It should be possible to decrypt the traffic, however, I need a copy of all public/private keypairs used for all encryption on the local machine.

Alternatively is there a good website where these sorts of captures or examples are available for download?


Once your client gets necessary information about the Tor network from directory servers, it routes all traffic through the entry guards (currently three) that it has chosen. That traffic is multiply encrypted, as explained here. The outermost encryption layer uses the public key of the entry guard.

In order to decrypt that traffic, you would need to know the entry guard's private key. But you don't, and so you can't decrypt the traffic.

| improve this answer | |
  • I was under the impression Tor uses PKE for key exchange but then uses symmetric encryption like SSL. If that's the case then knowing the private key of the client should allow you to decrypt the traffic. Problem is I don't think you can configure a client key. – user194 Jul 1 '14 at 7:11
  • Good point. OP might find useful information by logging. See torproject.org/docs/tor-manual.html.en at "Log [domain,…]minSeverity[-maxSeverity] … stderr|stdout|syslog". Maybe "log [crypto] debug syslog". – mirimir Jul 2 '14 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.