The Tor Browser uses the Tor network, which consists of more than six thousand relays located worldwide, to hide the users' location and online traffic. How does the Tor Browser keep my internet activity anonymous? It also enables software developers to create new communication tools with built-in privacy features. RFC 123 The RFC title - explanation of the RFC content.Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. However, if you know the TCP port used (see above), you can filter on that one.Ĭapture only the Tor traffic over the default port (80): tcp port 80 External links You cannot directly filter Tor protocols while capturing. Show only the Tor based traffic: tor Capture Filter Display FilterĪ complete list of Tor display filter fields can be found in the display filter reference Keep this file short, it's also a good idea to gzip it to make it even smaller, as Wireshark can open gzipped files automatically. XXX - Add a simple example capture file to the SampleCaptures page and link from here (see below). (XXX add links to preference settings affecting how Tor is dissected).

Also add info of additional Wireshark features where appropriate, like special statistics of this protocol. The Tor dissector is (fully functional, partially functional, not existing, … whatever the current state is).

Tor commonly uses ports 90 for network traffic and directory information. The well known TLS port for Tor traffic is 443. TCP: Typically, Tor uses TLS over TCP as its transport protocol.XXX - add a brief description of Tor history Protocol dependencies Traffic flowing down the circuit is sent in fixed-size `cells*, which are unwrapped by a symmetric key at each node (like the layers of an onion) and relayed downstream. Clients choose a path through the network and build a ` circuit*, in which each node (or onion router* or OR*) in the path knows its predecessor and successor, but no other nodes in the circuit.

Tor is a distributed overlay network designed to anonymize low-latency TCP-based applications such as web browsing, secure shell, and instant messaging.