How possible is it to capture and then analyse Tor traffic to/from your local machine (i.e., using wireshark)? I'm interested in more than just website requests / responses; I want to capture all traffic, including things such as circuit creation cells and descriptor publishing.

My attempts to do this so far have failed because I wasn't able to decrypt captured traffic. It should be possible to decrypt the traffic, however, I need a copy of all public/private keypairs used for all encryption on the local machine.

Alternatively is there a good website where these sorts of captures or examples are available for download?

1 Answer 1


Once your client gets necessary information about the Tor network from directory servers, it routes all traffic through the entry guards (currently three) that it has chosen. That traffic is multiply encrypted, as explained here. The outermost encryption layer uses the public key of the entry guard.

In order to decrypt that traffic, you would need to know the entry guard's private key. But you don't, and so you can't decrypt the traffic.

  • I was under the impression Tor uses PKE for key exchange but then uses symmetric encryption like SSL. If that's the case then knowing the private key of the client should allow you to decrypt the traffic. Problem is I don't think you can configure a client key.
    – user194
    Commented Jul 1, 2014 at 7:11
  • Good point. OP might find useful information by logging. See torproject.org/docs/tor-manual.html.en at "Log [domain,…]minSeverity[-maxSeverity] … stderr|stdout|syslog". Maybe "log [crypto] debug syslog".
    – mirimir
    Commented Jul 2, 2014 at 1:30

You must log in to answer this question.