Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How could I detect someone running a Tor bridge inside my local network? I guess I could use a Tor client and try all the IPs to see if they work as a bridge. Is there a faster solution? Maybe using nmap somehow? I am a normal user inside the network, so I don't control any switch, etc.

share|improve this question

Try wireshark/tcpdump, the dumps can be sorted for encrypted packets. Then just look for patterns.

Why are you looking for a bridge if you are not the admin?

share|improve this answer
    
I would hazard a guess of 'so he can have concrete evidence when he goes to the admins'. It's like having photos when you go to the police; they're more likely to listen and follow up if you can do half their work for them. – Myrddin Emrys Dec 7 '11 at 1:36
    
No, it's nothing involving police :) It's more like an experiment. Anyway, I am capturing traffic with wireshark but most of the TCP traffic appears encrypted. Every packet is around 60 bytes and looks encrypted or garbage, though I don't see a lot of TLS handshakes going on. Any idea how this is done? I haven't done anything special when setting up the connection. It uses DHCP. – user16367 Dec 8 '11 at 16:36
    
I can't say exactly what to look for. You might try setting up your own tor bridge and look for similarities, esp with the handshaking – November Dec 10 '11 at 0:43

A bridge is a way for external Internet users to access the Tor network. You could focus the testing to the external accessible IPs of your network. A lot of research remains on how to hide bridges better and experiments is good. Learn more about bridges here https://trac.torproject.org/projects/tor/search?q=bridge

share|improve this answer
    
My network has around 7000 IPs, though. There is no NAT. – user16367 Dec 9 '11 at 14:12
    
nmap scanning 7000 IPs as a normal user on the network is not advisable and will likely get you in trouble. – Johan Nilsson Dec 11 '11 at 8:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .