DNS Traffic of a Tor Exit Node - An Analysis

  • Michael SonntagEmail author
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11342)


The DNS traffic of a large-bandwidth Tor exit node is investigated for anomalies and compared to domain name registrations. From the results we can conclude what people are using the Tor network for. Some national anomalies can be identified - websites in China (.cn) and Russia (.ru/.su), and to some degree in Ukraine (.ua), are used differently through Tor than e.g. websites under the top-level domain of Germany (.de).


Anonymization Tor DNS Traffic statistics ccTLDs gTLDs 


  1. 1.
    Dingledine, R., Mathewson, N., Syverson, P.: Tor: the second-generation onion router. In: Proceedings of the 13th Conference on USENIX Security Symposium (SSYM 2004), vol. 13. USENIX Association, Berkeley (2004)Google Scholar
  2. 2.
    Sonntag, M., Mayrhofer, R., Hörmanseder, R.: Technical and legal determinants of implementing a Tor exit node. In: 33rd GEANT Networking Conference - TNC17 (2017).
  3. 3.
    Sonntag, M., Mayrhofer, R.: Traffic statistics of a high-bandwidth Tor exit node. In: Mori, P., Furnell, S., Camp, O. (eds.) Proceedings of 3rd International Conference on Information Systems Security and Privacy, pp. 270–277. SCITEPRESS (2017)Google Scholar
  4. 4.
    Greschbach, B., Pulls, T., Roberts, L.M., Winter, P., Feamster, N.: The effect of DNS on Tor’s anonymity. In: NDSS 2017. Internet Society, San Diego (2017)Google Scholar
  5. 5.
    Bortzmeyer, S.: DNS query name minimisation to improve privacy. RFC 7816.
  6. 6.
    Jansen, R., Johnson, A.: Safely measuring Tor. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS 2016), pp. 1553–1567. ACM, New York (2016)Google Scholar
  7. 7.
    Biryukov, A., Pustogarov, I., Thill, F, Weinmann, R.-P.: Content and popularity analysis of Tor hidden services. In: ICDCSW 2014, Proceedings of the 2014 IEEE 34th International Conference on Distributed Computing Systems Workshops, pp. 188–193. IEEE, New York (2014)Google Scholar
  8. 8.
    Loesing, K., Sandmann, W., Wilms, C., Wirtz, G.: Performance measurements and statistics of Tor hidden services, applications and the internet. In: 2008 International Symposium on Applications and the Internet, SAINT 2008, pp. 1–7. IEEE, New York (2008)Google Scholar
  9. 9.
    Ling, Z., Luo, J., Wu, K., Yu, W., Fu, X.: TorWard: discovery, blocking, and traceback of malicious traffic over Tor. IEEE Trans. Inf. Forensics Secur. 10(12), 2515–2530 (2015)CrossRefGoogle Scholar
  10. 10.
    Winter, P., et al.: Spoiled onions: exposing malicious Tor exit relays. In: De Cristofaro, E., Murdoch, Steven J. (eds.) PETS 2014. LNCS, vol. 8555, pp. 304–331. Springer, Cham (2014). Scholar
  11. 11.
    Johnson., A., Wacek, A., Jansen, R., Sherr, M., Syverson, P.: Users get routed: traffic correlation on tor by realistic adversaries. In: Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (CCS 2013), pp. 337–348. ACM, New York (2013)Google Scholar
  12. 12.
    Manils, P., Abdelberi, C., Blond, S.L., Kâafar, M.A., Castelluccia, C., Legout, A., Dabbous, W.: Compromising Tor anonymity exploiting P2P information leakage. CoRR (2010). arXiv:1004.1461
  13. 13.
    Federrath, H., Fuchs, K.-P., Herrmann, D., Piosecny, C.: Privacy-preserving DNS: analysis of broadcast, range queries and mix-based protection methods. In: Atluri, V., Diaz, C. (eds.) ESORICS 2011. LNCS, vol. 6879, pp. 665–683. Springer, Heidelberg (2011). Scholar
  14. 14.
  15. 15.
    Shalla’s Blacklists.
  16. 16.
    Black, S.: Unified Hosts File with Base Extensions.
  17. 17.
    Domaintools: Domain Count Statistics for TLDs.
  18. 18.
    Freedom House: Freedom on the Net 2017: Ukraine Country Profile.

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  1. 1.Institute of Networks and SecurityJohannes Kepler University LinzLinzAustria

Personalised recommendations