I use Tor inside a Virtual Machine. I run Wireshark on my Host. I want to detect Tor usage (for learning/studying) with Wireshark but don't know how? I have tried this:

tshark -r tor_traffic.cap -T fields -R "ssl.handshake.certificate" -e x509af.utcTime -e x509s at.printableString

but tshark output doesn't show any cert names. Are there any ways to accomplish this task?


You could check the list of Guard nodes from onionoo, for example at this Web site: https://onionoo.torproject.org
You may also filter the traffic to the addresses of your interest for better visibility.


Using tshark as mentioned in the question should work fine. However, it will require two pass analysis (which was not used in the provided link), and the filters will need to be updated a bit for more modern wireshark versions.


$ tshark -2 -r tor_traffic.pcap -T fields -R "ssl.handshake.certificate" -e x509af.utcTime -e x509sat.printableString                                                
15-01-23 00:00:00 (UTC),15-09-16 23:59:59 (UTC) www.mo7pofg5qx4qezly.com,www.imhw73oq35uluhcjz.net
15-02-12 00:00:00 (UTC),15-04-21 23:59:59 (UTC)
14-12-01 00:00:00 (UTC),15-05-03 00:00:00 (UTC) www.pghq2hykgwzwkgzghrn.com,www.b62klkcmc7zmt3s.net

Where tor_traffic.pcap has been pre-captured with your favorite tool (Wireshark, tcpdump, etc.). You'll also want to make sure the packet capture is run on whatever interface the VM is using.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.