Inspecting the Tor Network and Detecting Tor Traffic in Your Infrastructure

I read this post recently: How I got over 300 Tor exit nodes removed and I thought it was interesting that there is a lot of public information you can gather from the Tor network. A lot of it is public due to the nature of the way Tor works. I wanted to see what other information I could gather and how I can use that information to watch for Tor traffic in my own infrastructure. Turns out there’s a lot you can figure out and a lot of cloud providers already take this knowledge into account. Inspecting the Tor Network A lot of the Tor network is public. Tor has bridges and relays. Clients connecting to the Tor network need the list of relays to build circuits. Directory authorities, listed under “Signatures” in the Consensus Health page, publish a consensus every hour. Tor users stay anonymous by proxying their requests through 3 of these relays. No single relay knows both who a user is and where they’re going. Relays You can inspect the Tor network by hitting the Onionoo endpoint.…