How could I detect someone running a Tor bridge inside my local network? I guess I could use a Tor client and try all the IPs to see if they work as a bridge. Is there a faster solution? Maybe using nmap somehow? I am a normal user inside the network, so I don't control any switch, etc.

2 Answers 2


Try wireshark/tcpdump, the dumps can be sorted for encrypted packets. Then just look for patterns.

Why are you looking for a bridge if you are not the admin?

  • I would hazard a guess of 'so he can have concrete evidence when he goes to the admins'. It's like having photos when you go to the police; they're more likely to listen and follow up if you can do half their work for them. Dec 7, 2011 at 1:36
  • No, it's nothing involving police :) It's more like an experiment. Anyway, I am capturing traffic with wireshark but most of the TCP traffic appears encrypted. Every packet is around 60 bytes and looks encrypted or garbage, though I don't see a lot of TLS handshakes going on. Any idea how this is done? I haven't done anything special when setting up the connection. It uses DHCP.
    – user16367
    Dec 8, 2011 at 16:36
  • I can't say exactly what to look for. You might try setting up your own tor bridge and look for similarities, esp with the handshaking
    – November
    Dec 10, 2011 at 0:43

A bridge is a way for external Internet users to access the Tor network. You could focus the testing to the external accessible IPs of your network. A lot of research remains on how to hide bridges better and experiments is good. Learn more about bridges here https://trac.torproject.org/projects/tor/search?q=bridge

  • My network has around 7000 IPs, though. There is no NAT.
    – user16367
    Dec 9, 2011 at 14:12
  • nmap scanning 7000 IPs as a normal user on the network is not advisable and will likely get you in trouble. Dec 11, 2011 at 8:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .