I found this blog post which says that they were able to identify Tor traffic by using a software called caploader? Have any one tried this software? I wasn't able to try it by myself as the protocol identification feature is not activated in the trial version?

3 Answers 3


Netresec is a for profit organization, that is attempting to sell a product. If you want to examine tor packets, take a look at this great article.

  • This is one informative article. Interesting reference.
    – Roya
    Sep 3, 2014 at 23:47

Yes, CapLoader can identify the Tor version of SSL, as we've demonstrated here: http://netresec.com/?b=13400BE

The "TOR Packet Analysis" report (linked by @Aurora) simply classifies traffic to TCP 9001 as Tor. However, Tor traffic usually runs on several other ports, like TCP 443. CapLoader, on the other hand, does not rely on the TCP port number for the protocol identification.

We'd be happy to run a packet capture file through the commercial full version of CapLoader and share the output with you, if you can provide us with a PCAP file containing Tor traffic.

Additionally, if you'd like to share your PCAP publicly online (for example by posting it to CloudShark) then we'd be happy to publicly share the CapLoader output in this StackExchange thread.


Note: This is not an answer to OP's post. I'm unable to post a comment because I don't have at least 50 reputation points.

To: netresec

Thanks for letting us Tor users know about the product CapLoader.

But of what use is it to us, casual Tor users? (I've surfed to your website and it seems that your company's target market is corporate customers.)

To: Tor developers

This is a chance for you all to learn how to refine Tor in future versions in such a way that even CapLoader can't detect Tor in networks.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .