In order to follow along in this analysis. Please feel free to open this capture file with NetworkMiner, Was used to capture the localhost network traffic from Eldon’s computer.Ī PCAP file with the captured packets from Eldon’s PC can be accessed Which can be used to extract and reassemble data going to and from the Tor network.Ī user, let’s call him “Eldon”, used Tor for some dark-web activity on November 30, 2018.Įldon was using the Tor Browser on a Windows PC and RawCap NetworkMiner includes a SOCKS parser since version 2.1, In order to make sense of the captured traffic you need a tool that can parse the (RawCap is a portable standalone tool that doesn’t need WinPcap or NDIS drivers to work). If you’re running the Tor Browser in Windows, then we recommend using You can use tcpdump to capture the localhost traffic on PCs running the

Of all traffic a PC sends to and from the Tor network. This means that by sniffing traffic on localhost it’s actually possible to create a solid forensic trail Which connects to the proxy in order to have its traffic encrypted and forwarded to the Tor network. This local SOCKS proxy is used by the Tor Browser, Tor installations include a SOCKS proxy listening on TCP port 9150 on localhost (127.0.0.1). Using Tor 'rendezvous points,' other Tor users can connect to these onion services, formerly known as hidden services, each without knowing the other's network identity.”Ĭapturing Tor Traffic Before it gets Encrypted “Tor makes it possible for users to hide their locations while offering various kinds of services, such as web publishing or an instant messaging server. “Tor is free software and an open network that helps you defend against traffic analysis”

The Tor Project website describes the tool as: Tor is a secure platform that enables users to browse the web anonymously. In this blog post I show how anonymous Tor browsing can be visualized,īy loading a PCAP file with localhost traffic into NetworkMiner. Is sent between localhost TCP sockets on computers running Tor clients, such as the Tor Browser. Unencrypted network traffic, destined for the Tor network,

Visualize the tor network