[tor-talk] TOR and Obfsproxy packet size

[Justin]

Hello,
I’m not sure what the answer to your question about regular Tor is.  When it comes to Obfsproxy changing the 586 byte size, it’s to evade filters that use that to help block Tor.  The other packet length fluctuations would indicate that Obfsproxy makes the sizes of packets different so that it’s very difficult for a Deep packet inspection unit to fingerprint packet size and block Tor.

> On Nov 29, 2015, at 9:05 AM, Amin s <asgetlostman at gmail.com> wrote:
> 
> I have some questions about TOR and Obfsproxy packet size.
> 
>   1. TOR cell size is 512 bytes but most TOR packets have size of 586
>   bytes [1].
> 
> My question is that why there is such difference in size (74 bytes
> difference)?
> 
>   1. In my own testing, instead of TOR packets with size of 586 bytes,
>   there are packets with size of 543 bytes in TOR traffic and packets with
>   size of 565 bytes in Obfsproxy traffic.
> 
> My question here is that why doesn't TOR or Obfsproxy generate 586 bytes?
> the size that reported in lots of papers like link [1] ?
> 
>   1. In my own testing on TOR traffic, from 9939 packets that were sent
>   from client to server, there were 2648 packets with different sizes than
>   543, like 126,1086,1629,4101,612 and so on.
> 
> If TOR cell size is fixed, then why are there packets with different sizes
> than 543? (why don't all of the packets have the same 543 bytes in size?)
> 
> Relating to above question, there are lots of packets with size of 1460
> bytes in backward direction (from server to client). So what happens to the
> fixed cell size?
> 
> 
> [1] http://arxiv.org/pdf/1305.3199.pdf
> -- 
> tor-talk mailing list - tor-talk at lists.torproject.org
> To unsubscribe or change other settings go to
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk