We're doing an assignment on net anonymity, especially about Tor. We're trying to find out where Tor users are coming from. In order to achieve this, we set up a Tor node and disabled scrambled logging. However, filtering IP addresses from a log file isn't the most efficient way, plus a lot of IP addresses belong to exit nodes that aren't actually used by clients. With clients I mean humans using Tor.
Is there a way, for an entry guard, to see whether it's being used as first node in a circuit by a client?