I found this blog post which says that they were able to identify Tor traffic by using a software called caploader? Have any one tried this software? I wasn't able to try it by myself as the protocol identification feature is not activated in the trial version?
Add a comment
|
Netresec is a for profit organization, that is attempting to sell a product. If you want to examine tor packets, take a look at this great article.
Yes, CapLoader can identify the Tor version of SSL, as we've demonstrated here: http://netresec.com/?b=13400BE
The "TOR Packet Analysis" report (linked by @Aurora) simply classifies traffic to TCP 9001 as Tor. However, Tor traffic usually runs on several other ports, like TCP 443. CapLoader, on the other hand, does not rely on the TCP port number for the protocol identification.
We'd be happy to run a packet capture file through the commercial full version of CapLoader and share the output with you, if you can provide us with a PCAP file containing Tor traffic.
Additionally, if you'd like to share your PCAP publicly online (for example by posting it to CloudShark) then we'd be happy to publicly share the CapLoader output in this StackExchange thread.
Note: This is not an answer to OP's post. I'm unable to post a comment because I don't have at least 50 reputation points.
To: netresec
Thanks for letting us Tor users know about the product CapLoader.
But of what use is it to us, casual Tor users? (I've surfed to your website and it seems that your company's target market is corporate customers.)
To: Tor developers
This is a chance for you all to learn how to refine Tor in future versions in such a way that even CapLoader can't detect Tor in networks.
