Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am capturing network traffic using TCPDUMP with the following command:

TCPDUMP -i wlan0 -ttt port 9050 -w test.txt

How can I guarantee that all captured packet are TOR packets?

share|improve this question
4  
You don't. That's the whole point of TOR (well, since they released that module to disguise traffic - there are some identifying signatures of plain TOR traffic but I don't know what they are off the top of my head). Short of blocking all SSL (which will make many users very unhappy with you, I guarantee), you cannot. –  Bob May 4 '13 at 14:58
    
So what I mean now is to find a way to know that certain packet is tor packet. one way to do it is to check whether the exit node ip is tor relay IP or not. the problem is where I can find the configuration file that contains the IP's of all tor relies. –  msbs2013 May 5 '13 at 10:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.