[tor-talk] TOR and Obfsproxy packet size

[Philipp Winter]

On Sun, Nov 29, 2015 at 06:35:12PM +0330, Amin s wrote:
>    1. TOR cell size is 512 bytes but most TOR packets have size of 586
>    bytes [1].
> 
> My question is that why there is such difference in size (74 bytes
> difference)?

The difference is caused by the protocol headers that are wrapped around
Tor cells; IP, TCP, and TLS.

>    1. In my own testing, instead of TOR packets with size of 586 bytes,
>    there are packets with size of 543 bytes in TOR traffic and packets with
>    size of 565 bytes in Obfsproxy traffic.
> 
> My question here is that why doesn't TOR or Obfsproxy generate 586 bytes?
> the size that reported in lots of papers like link [1] ?

How did you run your test?  543 sounds like the TCP segment length and
not like the length of the IP packet.

Also, obfsproxy is just a framework.  Which obfuscation protocol did you
run?  Obfs3?

>    1. In my own testing on TOR traffic, from 9939 packets that were sent
>    from client to server, there were 2648 packets with different sizes than
>    543, like 126,1086,1629,4101,612 and so on.
> 
> If TOR cell size is fixed, then why are there packets with different sizes
> than 543? (why don't all of the packets have the same 543 bytes in size?)

First, Tor has static-length and variable-length cells, so it's not
entirely fixed.  Second, what actually ends up on the wire isn't only up
to the tor client.  It depends on TCP, which tries to fill the link MTU
if there's enough data in the send buffer.

> [1] http://arxiv.org/pdf/1305.3199.pdf

You should read the peer-reviewed version of this paper instead:
<http://www.cs.kau.se/philwint/pdf/wpes2013.pdf>

Cheers,
Philipp