# Detect tor **URL:** \ **Category:** Zeek\ **Created:** [February 22, 2017, 1:12am UTC](https://community.zeek.org/t/detect-tor/4684 "2017-02-22T01:12:48Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\ **Post date:** [February 22, 2017, 1:12am UTC](https://community.zeek.org/t/detect-tor/4684/1 "2017-02-22T01:12:48Z")
Hi, Which is the best TOR detection script in bro ? below on is good , or any other script there [https://raw.githubusercontent.com/sethhall/bro-junk-drawer/master/detect-tor.bro](https://raw.githubusercontent.com/sethhall/bro-junk-drawer/master/detect-tor.bro) Regards, Sunu ---
**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\ **Post date:** [February 22, 2017, 9:50am UTC](https://community.zeek.org/t/detect-tor/4684/2 "2017-02-22T09:50:27Z")
---
**Author:** ![fatema\_bannatwala](https://avatars.discourse-cdn.com/v4/letter/f/5f9b8f/32.png) [@fatema\_bannatwala](https://community.zeek.org/u/fatema_bannatwala)\ **Post date:** [February 22, 2017, 1:21pm UTC](https://community.zeek.org/t/detect-tor/4684/3 "2017-02-22T13:21:32Z")
Another thing you could try is, if you use intel framework, then you can feed the intel FW with the IOCs data for TOR, and load it in Intel, so that you will get logs in intel.log, whenever there’s a hit on TOR IPs in your network traffic. Thanks, Fatema. ---
**Author:** ![ps\_sunu](https://avatars.discourse-cdn.com/v4/letter/p/9d8465/32.png) [@ps\_sunu](https://community.zeek.org/u/ps_sunu)\ **Post date:** [February 22, 2017, 3:26pm UTC](https://community.zeek.org/t/detect-tor/4684/4 "2017-02-22T15:26:36Z")
ok thanks for your info ---
**Author:** ![Richard\_Johnson](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@Richard\_Johnson](https://community.zeek.org/u/Richard_Johnson)\ **Post date:** [February 23, 2017, 4:20am UTC](https://community.zeek.org/t/detect-tor/4684/5 "2017-02-23T04:20:01Z")
If you want valid, low false positive, detection of the public Tor (not TOR) network use, you can look at the descriptors of the public relays. Get them from any Tor node you run, or download from the Tor Project site. That will give you IP addresses and ports over time. A connection to those is very probably Tor user-\>network traffic. A connection to a Tor node's IP on a port that isn't listed as a Tor port at the time of interest is much less likely to be Tor traffic. That's one of the failings of intel feeds listing only IPs, as almost all do when it comes to Tor. Bridges complicate the picture, as they're handed only to a limited subset of users. There, you may want to consider active measures--connect to the same port yourself, see if you can evoke a Tor handshake. China's delay on active probing of the ports was on the order of hours to days when this was most popular; they may have gotten faster since. Trying to ID Tor traffic characteristics is not as easy as it used to be. DPI vendors can often keep up, but it's unlikely they'll share the competitive advantage. Further along the arms race, bridges using pluggable transports like obfs4, or connections using domain fronting are not going to be easily detected, even by active probing. Richard ---
**Author:** ![Daniel\_Guerra](https://avatars.discourse-cdn.com/v4/letter/d/b5ac83/32.png) [@Daniel\_Guerra](https://community.zeek.org/u/Daniel_Guerra)\ **Post date:** [February 23, 2017, 9:52am UTC](https://community.zeek.org/t/detect-tor/4684/6 "2017-02-23T09:52:04Z")
Tor can be detected by looking at the ssl certificates. Because the certificates are generated by tor, the subject issuer or ssl\_hostname can be used to detect it. This example matches only if subject and issuer match. I have seen tor connections module DetectTor; event ssl\_established(c: connection ) &priority=6         {                 if ( c$ssl?$subject && /^CN=www.[0-9a-zA-Z]+.(net|com)$/ == c$ssl$subject && c$ssl?$issuer && /^CN=www.[0-9a-zA-Z]+.(com|net)$/ == c$ssl$issuer || (c$ssl?$server\_name && /^CN=www.[0-9a-zA-Z]+.(net|com)$/ == c$ssl?$server\_name )                         {                                 add c$service["tor"];                         }         } Regards, Daniel ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/detect-tor/4684/7 "2022-05-06T15:44:40Z")