Traffic Statistics of a High-Bandwidth Tor Exit Node

Michael Sonntag, René Mayrhofer


The Tor anonymization network supports (and is widely used for) circumventing censorship, evading intrusive mass-surveillance, and generally protecting privacy of Internet users. However, it also carries traffic that is illegal in various jurisdictions. It is still an open question how to deal with such illegal traffic in the Tor network, balancing the fundamental human right for privacy with the need for assisting executive forces. By operating and monitoring a high-bandwidth Tor exit node as both a technical and legal experiment, we statistically analyse where popular servers are located and how they are used based on connection metadata of actual exit node usage. Through this we identify inter alia that cooperation only in comparatively few countries would be needed – or any illegal use would be very small. In this paper, we provide more in-depth statistical insight into Tor exit node traffic than previously publicly available.


  1. asn, Some statistics about onions, [online] Available at: [Accessed 21.9.2016]
  2. Ailanthus. 2015. Ethical Tor research: Guidelines, [online] [Accessed 21.9.2016]
  3. Akamai, 2015. akamai's [state of the internet] / security Q2 2015 report, [online] en/multimedia/documents/state-of-the-internet/2015- q2-cloud-security-report.pdf [Accessed 21.9.2016]
  4. Biryukov, A., Pustogarov, I., Thill, F, and Weinmann, R.- P. 2014. Content and Popularity Analysis of Tor Hidden Services, ICDCS Workshops 2014, 188-193
  5. Callahan, T., Allman, M., and Paxson, V. 2010. A longitudinal view of HTTP traffic. Proceedings of the 11th international conference on Passive and active measurement (PAM'10), Springer-Verlag, 222-231.
  6. Chaabane, A., Manils, P., and Kaafar, M.2010. Digging into anonymous traffic: A deep analysis of the Tor anonymizing network, Proceedings of the 4th International Conference on Network and System Security (NSS), 2010, 167-174.
  7. INS, 2016. Tor system setup, [online] Available at [Accessed 21.9.2016]
  8. Jansen, R., Johnson, A., 2016. Safely Measuring Tor. Proceedings of CCS'16. To appear
  9. Ling, Z., Luo, J., Wu, K., Yu, W., and Fu, X. 2015. TorWard: Discovery, Blocking, and Traceback of Malicious Traffic Over Tor, IEEE Tr. on Information Forensics and Security, Vol 10/12, 2515 - 2530
  10. Loesing, K., Sandmann, W., Wilms, C., and Wirtz, G. 2008. Performance Measurements and Statistics of Tor Hidden Services, Applications and the Internet. SAINT 2008. Turku, 2008, 1-7
  11. Loesing, K., Murdoch, S. J., and Dingledine, R. 2010. A case study on measuring statistical data in the tor anonymity network, Proceedings of the 14th international conference on Financial cryptograpy and data security (FC'10), Springer, 203-215
  12. MaxMind, GeoLite2 Legacy Downloadable Databases, [online] [Accessed 21.9.2016]
  13. McCoy, D., Bauer, K., Grunwald, D., Kohno, T., and Sicker, D. 2008. Shining light in dark places: Understanding the Tor network, Proceedings of the 8th International Symposium on Privacy Enhancing Technol. (PETS), 63-76
  14. Pmacct project, [online] [Accessed 21.9.2016]
  15. Soghoian, C., 2011. Enforced Community Standards For research on Users of the Tor Anonymity Network, Proc. 2011 International Conference on Financial Cryptography and Data Security, Springer, 146-153
  16. Sonntag, M., 2015. Rechtsfragen im Zusammenhang mit dem Betrieb eines Anonymisierungsdienstes. JusIT 6, 2015, 215-222

Paper Citation

in Harvard Style

Sonntag M. and Mayrhofer R. (2017). Traffic Statistics of a High-Bandwidth Tor Exit Node . In Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP, ISBN 978-989-758-209-7, pages 270-277. DOI: 10.5220/0006124202700277

in Bibtex Style

author={Michael Sonntag and René Mayrhofer},
title={Traffic Statistics of a High-Bandwidth Tor Exit Node},
booktitle={Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,},

in EndNote Style

JO - Proceedings of the 3rd International Conference on Information Systems Security and Privacy - Volume 1: ICISSP,
TI - Traffic Statistics of a High-Bandwidth Tor Exit Node
SN - 978-989-758-209-7
AU - Sonntag M.
AU - Mayrhofer R.
PY - 2017
SP - 270
EP - 277
DO - 10.5220/0006124202700277