Can my ISP see that I am operating a hidden service?

Question

Is my ISP able to see that I run a hidden service from the network traffic I make? My ISP does not allow me to use Tor according to their Terms of Service. The hidden service will do nothing illegal but I am still worried about them shutting us down.

Answer 1

Your ISP is able to figure out that you're using Tor from the network traffic you make. In particular they can analyze ordinary Tor traffic for telltale fingerprints. If you live in a (relative to those less fortunate) free, fair, democratic nation, they really shouldn't be able to say you cannot use Tor. This is because ordinary Tor traffic uses TLS for link authentication and encryption. Although Tor makes efforts to appear as TLS web traffic some differences are evident. The reason I mention free, and fair nations is because differentiation requires inspection. Your ISP cannot say you may not use Tor unless they can also put restrictions on TLS traffic in general.

Things to consider

1. They have to pay attention and analyze the traffic to figure that out but eventually they will figure it out. Sooner if they are attentive and later if they suffer from overloaded staff and cost reducing business structure. However, there are simpler ways that they can figure out that you are using Tor network. The Tor IP addresses are public, so they can figure out you are using Tor just by checking the IP addresses that you use. They can check the available data as easily as you (for example by entering your guard's IP into Atlas). You should seriously consider the consequences that you may encounter and have a plan of action when (but not if) they figure out you are using Tor and running a hidden service.

2. Your ISP may be enforcing a residential TOU that says you cannot run a server (restricting relay-only and exit-node traffic). They may also be enforcing a TOU that prevents copyright infringement (restricting exit-node traffic). They may not (unless they're bad) restrict your use of Tor in client operation. Hidden services fall, largely, into this last category because your client will maintain some (egress/outgoing) circuits with your HS guards as the destination. This is the same type of behavior a Tor client will exhibit upon connecting. What this means is that if you use a residential connection and you can use Tor in client operation you can also run a hidden service without violating your ISP's TOU.

All this being said I would check again if your ISP TOU prevents Tor use as a client. Don't tell them you would like to run a hidden service, but rather, check for Tor client use. If they don't allow client use I would question how they handle other anonymity services. Do they also prevent web-proxy access? Do they block VPN connections? If they allow VPN connections this presents an interesting solution. You could connect to a VPN first and run Tor over the VPN.

Good luck!