Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am capturing network traffic using TCPDUMP with the following command:

TCPDUMP -i wlan0 -ttt port 9050 -w test.txt

How can I guarantee that all captured packet are TOR packets?

share|improve this question
You don't. That's the whole point of TOR (well, since they released that module to disguise traffic - there are some identifying signatures of plain TOR traffic but I don't know what they are off the top of my head). Short of blocking all SSL (which will make many users very unhappy with you, I guarantee), you cannot. – Bob May 4 '13 at 14:58
So what I mean now is to find a way to know that certain packet is tor packet. one way to do it is to check whether the exit node ip is tor relay IP or not. the problem is where I can find the configuration file that contains the IP's of all tor relies. – msbs2013 May 5 '13 at 10:12

You must log in to answer this question.

Browse other questions tagged .