Recorded private-network output, 7 October 2026 Tor version 0.4.9.13. This is lab traffic only. IDs and paths can differ on another run. Captures ran simultaneously for ten seconds. Headers below are excerpts. Counts were computed from the complete saved capture text before excerpting. Binary payload is omitted. These counts are observations, not proof of encryption. Requests:

Hello from the web server inside the private Tor network.

Marker: audit-marker-01 Stream 28 used circuit 2: da -> relay2 -> exit1 Positions: guard -> middle -> exit

Hello from the web server inside the private Tor network.

Marker: audit-marker-02 Stream 31 used circuit 7: da -> relay1 -> exit1 Positions: guard -> middle -> exit

Hello from the web server inside the private Tor network.

Marker: audit-marker-03 Stream 34 used circuit 8: da -> relay1 -> exit1 Positions: guard -> middle -> exit Web log: web-1 | Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ... web-1 | 10.77.0.13 - - [07/Oct/2026 15:07:47] "GET /?audit-marker-01 HTTP/1.1" 200 - web-1 | 10.77.0.100 - - [07/Oct/2026 15:07:56] "GET /?audit-direct HTTP/1.1" 200 - web-1 | 10.77.0.13 - - [07/Oct/2026 15:08:07] "GET /?audit-marker-02 HTTP/1.1" 200 - web-1 | 10.77.0.13 - - [07/Oct/2026 15:08:18] "GET /?audit-marker-03 HTTP/1.1" 200 - Guard capture (da): Packet headers: 324 Headers mentioning 10.77.0.100: 88 Headers mentioning 10.77.0.80: 0 Occurrences of audit-marker-01 in complete capture text: 0 Observed IP pairs: 10.77.0.10 -> 10.77.0.100 10.77.0.10 -> 10.77.0.11 10.77.0.10 -> 10.77.0.12 10.77.0.10 -> 10.77.0.13 10.77.0.10 -> 10.77.0.14 10.77.0.100 -> 10.77.0.10 10.77.0.11 -> 10.77.0.10 10.77.0.12 -> 10.77.0.10 10.77.0.13 -> 10.77.0.10 10.77.0.14 -> 10.77.0.10 Header excerpts: 2026-10-07 15:07:46.905646 IP 10.77.0.100.57582 > 10.77.0.10.5000: Flags [P.], seq 3673650497:3673651033, ack 3151577181, win 83, options [nop,nop,TS val 701088483 ecr 2695797422], length 536 2026-10-07 15:07:46.906631 IP 10.77.0.10.5000 > 10.77.0.100.57582: Flags [P.], seq 1:537, ack 536, win 76, options [nop,nop,TS val 2695798418 ecr 701088483], length 536 2026-10-07 15:07:46.906666 IP 10.77.0.100.57582 > 10.77.0.10.5000: Flags [.], ack 537, win 83, options [nop,nop,TS val 701088484 ecr 2695798418], length 0 2026-10-07 15:07:46.907220 IP 10.77.0.100.57582 > 10.77.0.10.5000: Flags [P.], seq 536:1072, ack 537, win 83, options [nop,nop,TS val 701088484 ecr 2695798418], length 536 2026-10-07 15:07:46.909890 IP 10.77.0.10.5000 > 10.77.0.100.57582: Flags [P.], seq 537:1073, ack 1072, win 76, options [nop,nop,TS val 2695798421 ecr 701088484], length 536 2026-10-07 15:07:46.910523 IP 10.77.0.100.57582 > 10.77.0.10.5000: Flags [P.], seq 1072:1608, ack 1073, win 83, options [nop,nop,TS val 701088487 ecr 2695798421], length 536 Middle capture (relay2): Packet headers: 95 Headers mentioning 10.77.0.100: 0 Headers mentioning 10.77.0.80: 0 Occurrences of audit-marker-01 in complete capture text: 0 Observed IP pairs: 10.77.0.10 -> 10.77.0.12 10.77.0.12 -> 10.77.0.10 10.77.0.12 -> 10.77.0.13 10.77.0.13 -> 10.77.0.12 Header excerpts: 2026-10-07 15:07:47.019887 IP 10.77.0.12.5000 > 10.77.0.10.39792: Flags [P.], seq 369482164:369482700, ack 3249314216, win 77, options [nop,nop,TS val 2653116424 ecr 2310787540], length 536 2026-10-07 15:07:47.020679 IP 10.77.0.10.39792 > 10.77.0.12.5000: Flags [P.], seq 1:537, ack 536, win 87, options [nop,nop,TS val 2310788537 ecr 2653116424], length 536 2026-10-07 15:07:47.020688 IP 10.77.0.12.5000 > 10.77.0.10.39792: Flags [.], ack 537, win 77, options [nop,nop,TS val 2653116425 ecr 2310788537], length 0 2026-10-07 15:07:47.021191 IP 10.77.0.12.5000 > 10.77.0.10.39792: Flags [P.], seq 536:1072, ack 537, win 77, options [nop,nop,TS val 2653116425 ecr 2310788537], length 536 2026-10-07 15:07:47.024556 IP 10.77.0.10.39792 > 10.77.0.12.5000: Flags [P.], seq 537:1073, ack 1072, win 87, options [nop,nop,TS val 2310788540 ecr 2653116425], length 536 2026-10-07 15:07:47.025172 IP 10.77.0.12.5000 > 10.77.0.10.39792: Flags [P.], seq 1072:1608, ack 1073, win 77, options [nop,nop,TS val 2653116429 ecr 2310788540], length 536 Exit capture (exit): Packet headers: 78 Headers mentioning 10.77.0.100: 0 Headers mentioning 10.77.0.80: 12 Occurrences of audit-marker-01 in complete capture text: 2 Observed IP pairs: 10.77.0.10 -> 10.77.0.13 10.77.0.11 -> 10.77.0.13 10.77.0.12 -> 10.77.0.13 10.77.0.13 -> 10.77.0.10 10.77.0.13 -> 10.77.0.11 10.77.0.13 -> 10.77.0.12 10.77.0.13 -> 10.77.0.80 10.77.0.80 -> 10.77.0.13 Header excerpts: 2026-10-07 15:07:47.167900 IP 10.77.0.13.40396 > 10.77.0.80.80: Flags [S], seq 3555911058, win 64240, options [mss 1460,sackOK,TS val 1871435982 ecr 0,nop,wscale 10], length 0 2026-10-07 15:07:47.167914 IP 10.77.0.80.80 > 10.77.0.13.40396: Flags [S.], seq 1210009252, ack 3555911059, win 65160, options [mss 1460,sackOK,TS val 3568326866 ecr 1871435982,nop,wscale 10], length 0 2026-10-07 15:07:47.167922 IP 10.77.0.13.40396 > 10.77.0.80.80: Flags [.], ack 1, win 63, options [nop,nop,TS val 1871435982 ecr 3568326866], length 0 2026-10-07 15:07:47.171270 IP 10.77.0.13.40396 > 10.77.0.80.80: Flags [P.], seq 1:91, ack 1, win 63, options [nop,nop,TS val 1871435985 ecr 3568326866], length 90: HTTP: GET /?audit-marker-01 HTTP/1.1 2026-10-07 15:07:47.171285 IP 10.77.0.80.80 > 10.77.0.13.40396: Flags [.], ack 91, win 64, options [nop,nop,TS val 3568326869 ecr 1871435985], length 0 2026-10-07 15:07:47.172243 IP 10.77.0.80.80 > 10.77.0.13.40396: Flags [P.], seq 1:187, ack 91, win 64, options [nop,nop,TS val 3568326870 ecr 1871435985], length 186: HTTP: HTTP/1.0 200 OK ASCII request line; leading binary header omitted: GET /?audit-marker-01 HTTP/1.1