16

I run a web server. Can I distinguish between traffic that has been routed via Tor and that which hasn't?

16

Yes. There are two ways to recognize Tor users.

The first way is through their IP address -- the list of Tor relays is public, so you can check whether the user is coming from a known Tor relay. It's actually a little bit trickier than that though, first because every Tor relay has an exit policy (so only some relays will allow users to reach your site), and second because some Tor exit relays are multi-homed, meaning they list (and listen on) a different IP address than the one they use for outgoing traffic. We offer a "bulk exit relay list" service that you can use to fetch a list of recent IP addresses whose exit policies allow connections to your site: https://check.torproject.org/cgi-bin/TorBulkExitList.py

And as Jens points out, if somebody visits your website from an IP address that also runs a Tor exit, you won't be able to tell the difference. That's especially important in places where many users are NATed behind a single shared IP address.

The second way is by looking at various application-level characteristics. Torbutton, and the changes in Tor Browser, are designed to make all Tor users blend together, but they're not designed to make every Tor user indistinguishable from all other normal web browsers. So you can probably build a signature based on the differences that the Tor Browser introduces (tells you the time zone is GMT, doesn't answer certain JavaScript queries, doesn't answer certain history requests, etc) to make a pretty good Tor user recognizer. Of course, if the user isn't using Tor Browser, then this one wouldn't work.

I should also point out that being able to distinguish Tor users doesn't break their anonymity. The goal of Tor is to prevent any single point from learning that this user went to that destination. You're not learning the location of the user here -- only that she is one of the million+ Tor users.

And finally, there's a FAQ entry that's relevant too: "You should hide the list of Tor relays, so people can't block the exits."

  • 2
    Don't refer to another answer as if this is a running conversation. This answer may (and does now) sort ahead of Jens', leaving the reader to wonder to what you meant to refer. – pmocek Sep 30 '13 at 1:54
3

The list of Tor relays is public and can be accessed via different means. So you can basically check if the current connecting client is listed as relay or not. This gives you a first, good approximation.

However someone can run a relay and use this computer for everyday web surfing which is not routed through Tor. In this case the above mentioned check will say yes because the IP belongs to a relay, but the user didn't use Tor.

  • So other than the IP address of the client I have nothing to go on? – Tom Medley Sep 26 '13 at 8:45
  • 1
    It might be worth adding that the Tor Project even offers a service for that: torproject.org/projects/tordnsel.html.en – Philipp Winter Sep 26 '13 at 8:48
  • You will only get false positives if you are doing the wrong thing and including non-exit relays in your check. If you use something like TorDNSEL, then only IPs belonging to Exits will be flagged. – user78 Sep 26 '13 at 8:51
0

You can detect Tor users using TorDNSEL - https://www.torproject.org/projects/tordnsel.html.en.

Or you can just use https://github.com/assafmo/IsTorExit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.