Thank you for this. This may be a stupid question, but how would your ISP know you were actively running a Tor (non-node) connection?
Obviously I need to read up on all the back-end tech but I would assume that if it was easy to identify someone using Tor, it would no longer provide the anonymity / security because it would clearly identify outliers.
It makes sense to ban someone running a node off their Comcast connection (not because it's logical but because of their high traffic / server banning track record) but for Comcast to detect a browsing session? Seems odd.
Using DPI or even just flow analysis (sizes, port numbers, destination addresses, protocol (TCP/UDP) bits, and timings of packets), it should be possible to distinguish between encrypted TOR and other encrypted protocols with ease.
Comments
Thank you for this. This may be a stupid question, but how would your ISP know you were actively running a Tor (non-node) connection?
Obviously I need to read up on all the back-end tech but I would assume that if it was easy to identify someone using Tor, it would no longer provide the anonymity / security because it would clearly identify outliers.
It makes sense to ban someone running a node off their Comcast connection (not because it's logical but because of their high traffic / server banning track record) but for Comcast to detect a browsing session? Seems odd.
Using DPI or even just flow analysis (sizes, port numbers, destination addresses, protocol (TCP/UDP) bits, and timings of packets), it should be possible to distinguish between encrypted TOR and other encrypted protocols with ease.