What metadata does Tor leak to my ISP?

Question

It is wellknown that an ISP can see when an end user is using Tor. What exactly can it infer by looking at the Tor traffic? Specifically

1. Can the ISP infer Tor bandwidth usage, i.e. actively downloading a file vs. an idle connection?
2. Can the ISP distinguish between a Tor handshake (when launching Tor initially) vs. an existing session?

Answer 1

Using Tor: Tor provides limited anonymity. The best-documented and best-tested attacks against Tor have one demanding requirement – that the attacker have access to the network infrastructure carrying the traffic.

De-anonymising Tor traffic works even better if you're able to see traffic at both ends – where it enters a network, and where it leaves the network.

While it's paranoid to think that any government would bother de-anonymising Tor on a mass scale, it's fair to say that if you, as an individual, end up being of interest to spooks, you can be identified – at least in theory.

Sources

For reference, I don't have enough rep to post more than 2 links, so the pastebin file contains the references.

The ISP can't see http/https requests or DNS queries. It can see that traffic is encrypted:

"The only thing the ISP can see is encrypted traffic heading to a tor server, so they can tell your using tor, but the data that is sent is totally encrypted, and they cant see it. also the exit node routes the encrypted website data back to you through the tor network, so the only node that your isp can see that you received data from is the entry node."

However, because they know that you are using TOR, they could (and probably do) measure the amount of traffic going over. They already measure the amount of traffic, and (I assume) it would be trivial to add a filter for TOR connections and measure that bandwidth usage separately.

Also, there are bad actors that can intercept traffic anyway: F-secure source

And here's a statement from a person who has set up a virtual ISP:

Firstly, an ISP "owns" the connection for administrative purposes, so in simple terms "anything is possible". That is - in the same way that you have control of your computer, the ISP has control over their network. They can do pretty much whatever they want with it because you connect through it.

This being said, they can tell when you are actively doing something vs not doing anything, as the traffic going over the line, although encrypted, would increase. They can't tell what it is or what you are doing, just whether you are active.

And TOR can be differentiated from other protocols.

Unsettling, isn't it?

Answer 2

Assuming you're using plain Tor (no bridges or other fancy stuff) your ISP will know the addresses of all Tor relays (They are public). Now the ISP watches your connections. It is able to specifically look at all connections which are going to Tor relays. This will enable the company to decide if you're sitting on an idle connection or doing something in the network.

When you launch Tor initially the client connects to publicly known directory authorities and downloads a list of all clients. So if your ISP sees those connections it can be sure that you opened your Tor client.