What does Tor do to the IP address a service sees?¶
title: "What does Tor do to the IP address a service sees?" card_id: "IP-067" status: "complete" source_document: "https://docs.google.com/document/d/1J04-__BwLIv6_xtLd847C86VKPUbtmphJQefY4TUP3g/edit?usp=drivesdk"
What does Tor do to the IP address a service sees?¶
Tor is designed to separate a user’s internet connection from the destination they contact.
It does this by routing traffic through several systems called relays.
A typical Tor connection uses an entry relay, a middle relay and an exit relay.
The user’s device creates layers of encryption around the traffic.
Each relay removes one layer and learns only the information it needs to pass the traffic to the next stage.
The entry relay can see the user’s apparent source IP address, but it doesn't normally know the final internet destination.
The middle relay connects the entry and exit stages without seeing both ends.
The exit relay makes the final connection to the destination service.
The website or platform will therefore normally record the exit relay’s public IP address.
That address may be used by many unrelated Tor users.
Resolving it identifies the network hosting the exit relay—not the customer connection from which the Tor circuit began.
The exit relay may change as new circuits are created. The same user can therefore appear under different exit addresses, while many users can appear under the same one.
Tor doesn't make every part of the activity invisible.
The destination service can still record accounts, cookies, uploaded information, behaviour and other application-level evidence.
If the traffic leaving the exit relay isn't protected by end-to-end encryption, the exit operator may also be able to observe its contents.
But the destination’s ordinary IP log doesn't reveal the complete path back through the Tor network.
Lists of known Tor exits can help classify an address, although the list must relate to the time of the event because relays can join, leave or change roles.
A Tor exit address establishes that the visible connection apparently came through Tor infrastructure.
It doesn't identify the original device or user.
Attribution normally has to rely on evidence outside the simple destination-IP record, such as accounts, devices, timing, communications, operational mistakes or other activity not successfully separated by Tor.