How do ISPs filter out Tor traffic when using a Tor Relay

Question

Tor website says that an ISP may perform Deep Packet Inspection (DPI) and figure out that I am using Tor.

References:

• https://www.torproject.org/docs/bridges.html.en
• https://www.torproject.org/projects/obfsproxy.html.en

As per my knowledge, a Tor generated data packet leaving my computer only has the destination IP and destination port which can be read by any third party. How can any kind of inspection at all understand that I am using Tor?

I understand that it is possible an ISP will figure out that I am using Tor if they have my Entry Nodes or Bridges IP address stored to be a Tor enter point. But I am fine with it. Totally. But what worries me is how can a deep packet inspection produce results I am using Tor?

If the packet leaving my computer is encrypted, then it should not be vulnerable to any type of inspection according to my vision. So this simply confuses me.

Answer 1

An attacker has several methods to find out that you're using Tor.

1. If you use plain Tor without bridges or other circumvention technology than the IP addresses are known to the world. An attacker just compares the IP addresses you're connecting to with those known Tor IP addresses. If you're connecting to one of those there is a good chance that you're using Tor.
2. Another way is to look at the ports you're connecting to. Tor uses an own set of ports in the default configuration. Just by looking at the ports an attacker would also knows that you're probably using Tor.
3. Furthermore your computer contacts directory authorities. Their IP addresses are known and when you connect to them an attacker will also draw their conclusions.
4. Now if you're going to use bridges the picture changes a bit. So it might be also the case that an attacker knows some of the available bridges. If you're connecting to one of them, the attacker will think you're using Tor.
5. Tor talks HTTPS (or better TLS) with the bridges. This doesn't exactly look like a browser talking to a webserver. So if an attacker analyses the connection and encounters some difference to normal HTTPS connections, he might also think you're using Tor.
6. The size of Tor's packages might give another clue for a local attacker.

Depending on the abilities of the attacker it might be possible to guess that you're using Tor. However several so-called pluggable transport try to further hide the fact that you're using Tor. So in the end it is an arms race.

Answer 2

Quite simply - the IP addresses of Tor nodes are not secret (in fact, they are necessarily public) - so nobody needs to do any "deep packet inspection". If you're sending data to a Tor node (e.g. on its OR port), then you're using Tor.

If you need to use Tor without revealing it, set up a private bridge (e.g. on a hosted VM)