Tor Experience

Classify Tor traffic

Weka is a collection of machine learning algorithms. It is an open source software that provides data preparation, classification, visualization, and more.

From features collected and stored in a CSV file, modify the data by adding the label (e.g. browsing, chat, p2p, etc.) of every flow.
Open the Weka software and select Tools->ArffViewer.
Open the CSV file.
Right-click the label header and set it to class.
Save the file as an arff file.
From the main interface of Weka, select Explorer.
Under the preprocess tab, click open file and select the created arff file.
Under the classify tab, select the preferred classifier and click start.

Weka main interface

Weka ArffViewer

Weka Explorer

Extract flow features from Tor traffic

CICFlowMeter (formerly ISCXFlowMeter) will be used to extract features from flows. It is an open source network traffic flow generator and analyser. From the forward and backward direction of flows, a total of 80 statistical features are computed.

To extract features from a pcap file, select Network->Offline.
Browse for the pcap file and indicate the location of the output file.
Modify the flow timeout, if necessary.
Once the flow features are calculated, a summary will be shown and a CSV file is created to store the computed features.

CICFlowMeter Interface

A Sample CSV File of the Features

Capture Tor packets

Create two virtual machines (VMs) for the workstation and gateway.
Configure IP forwarding.
- Gateway
  - Setup NAT interface (eth0)
  - Setup internal interface (eth1)

Workstation
- Setup internal interface (eth0)

Open Wireshark on gateway VM and capture packets in the eth1 interface.
Open Tor browser on workstation VM. Access an onion website.

ifconfig eth1 192.168.1.254 echo "1" > /proc/sys/net/ipv4/ip_forward iptables -F iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
ifconfig eth0 192.168.1.1 route add default gw 192.168.1.254

Accessed onion service using Tor

Snapshot of Tor packets

Tor exit router

Install Tor browser bundle

Download the latest stable version of the Tor browser.
1. wget https://www.torproject.org/dist/torbrowser/7.0.4/tor-browser-linux64-7.0.4_en-US.tar.xz
Extract the package archive.
1. tar -xvJf tor-browser-linux64-7.0.4_en-US.tar.xz
Go to the created directory and run the Tor browser.
1. cd tor-browser_en-US/ ./start-tor-browser
Tor Launcher should start and it will launch Firefox once it's connected to Tor.

Setup a hidden Tor service (.onion)

Install the Tor client.
1. sudo apt-get install tor
Once the installation is finished, the Tor client should be running on a default port of 9050.
Setup a web server.
If you have already installed one, it is still recommended to install a new separate web server for your hidden service. We will use ThttpD as our web server in this tutorial.
1. wget http://www.acme.com/software/thttpd/thttpd-2.27.tar.gz tar -zxvf thttpd-2.27.tar.gz
Go to the new directory to configure the web server.
1. sudo ./configure && make ./thttpd -p 5222 -h localhost
The last command started the web server listening to port 5222. You should be able to see if it's working by accessing http://localhost:5222/.
Configure your hidden service.
Open a file named torcc located in /etc/tor/ and look for the line:
1. ### This section is just for location-hidden services ###
Add the following lines under it:
1. HiddenServiceDir /home/username/hidden_service/ HiddenServicePort 80 127.0.0.1:5222
Change the username to your computer's username and hidden_service to whatever name you wish to put.
Restart Tor.
1. sudo service tor restart
When it restarts, it reads the file torrc, follows the instructions, and bootstraps your service into the Tor network. It will then automatically create the hidden_service directory
that you specified, and it will create two files there, private_key - a new public/private keypair for your hidden service and hostname - a public name for your service.
Open hidden Tor service.
Paste the hostname to your Tor web browser. If it works, you'll view the html page you set up in step 2. If it doesn't work, look in your logs for errors.

References:

Page updated

Report abuse