Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 5 down vote favorite

How could I detect someone running a Tor bridge inside my local network? I guess I could use a Tor client and try all the IPs to see if they work as a bridge. Is there a faster solution? Maybe using nmap somehow? I am a normal user inside the network, so I don't control any switch, etc.

share|improve this question

2 Answers

up vote 1 down vote

Try wireshark/tcpdump, the dumps can be sorted for encrypted packets. Then just look for patterns.

Why are you looking for a bridge if you are not the admin?

share|improve this answer
I would hazard a guess of 'so he can have concrete evidence when he goes to the admins'. It's like having photos when you go to the police; they're more likely to listen and follow up if you can do half their work for them. – Myrddin Emrys Dec 7 '11 at 1:36
No, it's nothing involving police :) It's more like an experiment. Anyway, I am capturing traffic with wireshark but most of the TCP traffic appears encrypted. Every packet is around 60 bytes and looks encrypted or garbage, though I don't see a lot of TLS handshakes going on. Any idea how this is done? I haven't done anything special when setting up the connection. It uses DHCP. – user16367 Dec 8 '11 at 16:36
I can't say exactly what to look for. You might try setting up your own tor bridge and look for similarities, esp with the handshaking – November Dec 10 '11 at 0:43
up vote 1 down vote

A bridge is a way for external Internet users to access the Tor network. You could focus the testing to the external accessible IPs of your network. A lot of research remains on how to hide bridges better and experiments is good. Learn more about bridges here https://trac.torproject.org/projects/tor/search?q=bridge

share|improve this answer
My network has around 7000 IPs, though. There is no NAT. – user16367 Dec 9 '11 at 14:12
nmap scanning 7000 IPs as a normal user on the network is not advisable and will likely get you in trouble. – Johan Nilsson Dec 11 '11 at 8:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.